Hi @DevanshuSyk , Can you please share exact parameters passed on for Install-AzSKTenantSecuritySolutionConsolidated? That will help us investigate further

from azts-docs.

Connect to AzureAD and AzAccount

Note: Tenant Id must be specified when connecting to Azure AD and AzAccount

$TenantId = ""
Connect-AzAccount -Tenant $TenantId
Connect-AzureAD -TenantId $TenantId

-----------------------------------------------------------------#

Step 2: Run installation command.

-----------------------------------------------------------------#

$DeploymentResult = Install-AzSKTenantSecuritySolutionConsolidated -ScanningIdentityHostSubId ""
-ScanningIdentityHostRGName 'AZTS' -ScanningIdentityName 'AZTS'
-SubscriptionId ' -ScanHostRGName 'AZTS'
-Location 'eastus2' -SubscriptionsToScan @("")
-SREEmailIds @('') #Email Ids of Site Reliability Engineers or Users who should receive monitoring alerts -GrantGraphPermissionToScanIdentity:$true
-GrantGraphPermissionToInternalIdentity:$true -SetupAzModules
-AzureEnvironmentName AzureCloud -EnableAutoUpdates
-EnableAzTSUI `
-Verbose

note:tennat and subid has been removed from the post

from azts-docs.

Hi @DevanshuSyk , seems "`" at end of each of the parameters is missing. Could you please add these and try again as below?

$DeploymentResult = Install-AzSKTenantSecuritySolutionConsolidated  -ScanningIdentityHostSubId "" `
-ScanningIdentityHostRGName 'AZTS' `
-ScanningIdentityName 'AZTS' `
-SubscriptionId ' ' `
-ScanHostRGName 'AZTS' `
-Location 'eastus2' `
-SubscriptionsToScan @("") `
-SREEmailIds @('')  `
 -GrantGraphPermissionToScanIdentity:$true `
-GrantGraphPermissionToInternalIdentity:$true `
-SetupAzModules `
-AzureEnvironmentName AzureCloud `
-EnableAutoUpdates `
-EnableAzTSUI `
-Verbose

from azts-docs.

Hello i am not sure what you mean by parameter missing ?
Are you referring to ScanningIdentityHostSubId or SubscriptionsToScan ? The sub id has been removed from post on purpose
Thankx for the help

from azts-docs.

Hi @DevanshuSyk , please check updated previous comment

from azts-docs.

Ah tyvm .Let me try again

from azts-docs.

Same error
Template deployment returned following errors: [10:08:12 AM - The deployment 'AzTSenvironmentsetup-20240604T100650' failed with error(s). Showing 3 out of 9 error(s).
Status Message: The Resource 'Microsoft.Web/sites/AzSK-AzTS-WebApi-31af7' under resource group 'AZTS' was not found. For more details please go to https://aka.ms/ARMResourceNotFoundFix (Code:ResourceNotFound)

Status Message: The Resource 'Microsoft.Web/sites/AzSK-AzTS-WebApi-31af7' under resource group 'AZTS' was not found. For more details please go to https://aka.ms/ARMResourceNotFoundFix (Code:ResourceNotFound)

Status Message: The Resource 'Microsoft.Web/sites/AzSK-AzTS-AutoUpdater-31af7' under resource group 'AZTS' was not found. For more details please go to https://aka.ms/ARMResourceNotFoundFix (Code:ResourceNotFound)

CorrelationId: 1b70944a-68a4-4a4e-831f-8ebf1a43312a].

from azts-docs.

Hi @DevanshuSyk ,

Thanks for sharing details, here it's showing only 3 errors out of 9. Can you please check apart from 'this resource not found' error is there any other error.
To see all errors, Go to Azure Portal --> Resource Group --> Deployments --> Check latest AzTS deployment details.

This information is needed to understand why required resource are not getting created.

from azts-docs.

hanxk for reply .Here you go .

{
"code": "DeploymentFailed",
"target": "/subscriptions//resourceGroups/AZTS/providers/Microsoft.Resources/deployments/AzTSenvironmentsetup-20240604T100650",
"message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.",
"details": [
{
"code": "ResourceNotFound",
"message": "The Resource 'Microsoft.Web/sites/AzSK-AzTS-WebApi-31af7' under resource group 'AZTS' was not found. For more details please go to https://aka.ms/ARMResourceNotFoundFix"
},
{
"code": "ResourceNotFound",
"message": "The Resource 'Microsoft.Web/sites/AzSK-AzTS-WebApi-31af7' under resource group 'AZTS' was not found. For more details please go to https://aka.ms/ARMResourceNotFoundFix"
},
{
"code": "ResourceNotFound",
"message": "The Resource 'Microsoft.Web/sites/AzSK-AzTS-AutoUpdater-31af7' under resource group 'AZTS' was not found. For more details please go to https://aka.ms/ARMResourceNotFoundFix"
},
{
"code": "ResourceNotFound",
"message": "The Resource 'Microsoft.Web/sites/AzSK-AzTS-AutoUpdater-31af7' under resource group 'AZTS' was not found. For more details please go to https://aka.ms/ARMResourceNotFoundFix"
},
{
"code": "ResourceNotFound",
"message": "The Resource 'Microsoft.Web/sites/AzSK-AzTS-UI-31af7' under resource group 'AZTS' was not found. For more details please go to https://aka.ms/ARMResourceNotFoundFix"
},
{
"code": "ResourceNotFound",
"message": "The Resource 'Microsoft.Web/sites/AzSK-AzTS-UI-31af7' under resource group 'AZTS' was not found. For more details please go to https://aka.ms/ARMResourceNotFoundFix"
},
{
"code": "ResourceNotFound",
"message": "The Resource 'Microsoft.Web/sites/AzSK-AzTS-UI-31af7/slots/Staging-31af7' under resource group 'AZTS' was not found. For more details please go to https://aka.ms/ARMResourceNotFoundFix"
},
{
"code": "ResourceNotFound",
"message": "The Resource 'Microsoft.Web/sites/AzSK-AzTS-UI-31af7/slots/Staging-31af7' under resource group 'AZTS' was not found. For more details please go to https://aka.ms/ARMResourceNotFoundFix"
},
{
"code": "RoleAssignmentUpdateNotPermitted",
"message": "Tenant ID, application ID, principal ID, and scope are not allowed to be updated."
}
]
}

from azts-docs.

This 'RoleAssignmentUpdateNotPermitted' error could occur, if try to run installation command multiple time in same RG, because conflicts occurs due to previous role assignments. If this is the case, please try following,

1. If you can create new Resource group, then please try installation command with new Resource group name. And once setup is completed, clean up old Resource group.

2. If you can't try with new Resource group, then we need to clean up old role assignments,

• Navigate to access management of the resource group (AzTS) where you want to deploy the AzTS instance.
• Find out previous role assignments for managed identity (name will follow this pattern "AzSK-AzTS-InternalMI-XXXXX").
• Delete the identified role assignments and re-run installation command.

from azts-docs.

Closing this issue as there has been no activity for couple of days. Please feel free to reopen if you have any further questions or comments.

from azts-docs.