User-assigned managed identities are required for deploying Cloud Connector. Ensure that Cloud Connector is not assigned an Azure System Managed Identity because that identity overrides the deployment requirements.

There are two user-assigned managed identities:

• Cloud Connector: Managed identity associated with Cloud Connectors to perform Azure operations such as network interface discovery and metric publishing.
• Function App (VMSS only): Managed identity associated with an Azure Function app. Azure Functions make API calls to perform operations such as instance termination, instance replacement, and metric reading.

Deployments without VMSS require only the Cloud Connector managed identity and the Network Contributor role.

Deployments with VMSS require both managed identities and the following roles:

• Cloud Connector
  • Network Contributor
  • Monitoring Metrics Publisher (VMSS only)
• Function App (VMSS only)
  • Network Contributor
  • Virtual Machine Contributor
  • Monitoring Contributor
  • Managed Identity Operator
  • Storage Blob Data Reader

To create managed identities and assign roles:

1. Log in to the Azure Portal.
2. Under Services, search for Managed Identities.
3. Click Create.
   The Create User Assigned Managed Identity page appears.
4. On the Basics tab:

• Subscription: Select the subscription with user access administrator permission to manage deployed resources.
• Resource group: Click Create new and enter a name for the resource group. A resource group is a collection of resources that share the same lifecycle, permissions, and policies.
• Region: Select the desired region for your deployment.
• Name: Enter a name for your user-assigned managed identity.

See image.

5. Click Next: Tags >.
6. On the Tags tab, configure tags to categorize resources, then click Next: Review + create >.
7. On the Review + create tab, review your managed identity configuration, and then click Create.
8. After your managed identity has been created, go to Managed Identities and select your managed identity.
9. From the left-side navigation, click Azure role assignments, then click Add role assignment (Preview).
10. In the Add role assignment (Preview) window:

• Scope: From the drop-down menu, select Subscription.
• Subscription: From the drop-down menu, select your subscription.
• Role: From the drop-down menu, select the role or roles specified above, one at a time.

See image.

11. Click Save.
12. (Scale Set deployments only) Repeat this procedure for the second managed identity.

Create an Azure key vault to securely store and access your secrets:

1. Log in to the Azure Portal.
2. Go to Key vaults, then click Create.
   The Create a key vault page appears.
3. On the Basics tab:

• Subscription: Select the subscription with user access administrator permission to manage deployed resources.
• Resource group: Select the resource group in which you want to create the key vault.
• Key vault name: Enter a name for your key vault.
• Region: Select the desired region for your deployment.
• Pricing tier: Select either Standard or Premium (includes support for HSM backed keys).
• Soft-delete: This setting is automatically enabled on this key vault. Soft-delete allows you to recover or permanently delete a key vault and secrets.
• Days to retain deleted vaults: Enter the desired period for retaining deleted vaults.
• Purge protection: Select either Disable purge protection (allow key vault and objects to be purged during retention period) or Enable purge protection (enforce a mandatory retention period for deleted vaults and vault objects).

See image.

4. Click Next.
5. On the Access policy tab:

• Access configuration: Select Vault access policy as the permission model.
• Resource access: Select Azure Resource Manager for template deployment.

See image.

6. Under Access policies, click Create.
7. In the Create an access policy window:

• Secret permissions: On the Permissions tab, under Secret permissions, select Get and List, then click Next.

See image.

• Principal: On the Principal tab, select your recently created managed identity, then click Next.

See image.

8. Click Create.
9. Click Next.
10. On the Networking tab:

• Connectivity Configuration: Select Public Access to connect to the key vault publicly.
• Allow access from: Select All networks.

See image.

11. Click Next.
12. On the Tags tab, configure tags to categorize resources, then click Next.
13. On the Review + Create tab, review the summary of your configurations and click Create.

Create secrets to store in your key vault:

1. Log in to the Azure Portal.
2. Go to Key vaults, then select your newly created key vault.
3. In the left-side navigation, click Secrets, then click Generate/Import.
   The Create a secret page appears.
4. Add the following secrets:

• api-key: For the name of your secret, enter api-key. For the corresponding value, enter the value from the API Keys page on the Admin Portal.
• password: For the name of your secret, enter password. For the corresponding value, enter your Admin Portal password.
• username: For the name of your secret, enter username. For the corresponding value, enter your Admin Portal username.

See image.

5. Click Create.

See image.

Create an SSH key pair:

1. Log in to the Azure Portal.
2. Go to SSH keys, then click Create.
   The Create an SSH key page appears.
3. On the Basics tab:

• Subscription: From the drop-down menu, select the subscription with user access administrator permission to manage deployed resources.
• Resource Group: Select the resource group in which you want to create the SSH key pair or click Create new to create a new resource group.
• Region: From the drop-down menu, select the desired region in which to deploy the newly created resource group. If you do not select a region, the SSH key region will be in the same region as the existing resource group selected above.
• Key pair name: Enter a name for your key pair.

• SSH public key source: From the drop-down menu, select Generate new key pair.

  See image.

  

  Close

4. Click Next: Tags >.
5. On the Tags tab, configure tags to categorize resources, then click Next: Review + create >.
6. On the Review + create tab, review your SSH key configurations, and then click Create.