Create onboarding scripts

Create the Bash and PowerShell scripts for onboarding using the service principal.


There are a number of ways to onboard VMs at scale. Some are detailed in the Azure docs for Arc and there are more still in the Azure Arc Jumpstart.

The most basic way is to use the portal to generate scripts which can then be used on multiple servers.

This is a good fit with customers who prefer to retain their own admin access to the on prem servers and have their own preferred tooling for remote execution of scripts on multiple hosts. It could be simple scripted WinRM and ssh commands, or something more industrial such as System Center, Ansible, Chef, Puppet, Salt etc.

A good opportunity for someone different to take control.

The scripts may commonly be created by a consultant from the partner and then given to the on prem admin team to execute.

Providing the generated script and service principal credentials to others for execution is not considered a security issue. The very limited RBAC role given to the service principal is only capable of onboarding VMs and nothing more.

The end point of this lab will emulate that script handover as it is closer to the workflow you would see in a professional services engagement.

Service principal

  1. Grab the resource id for the arc_pilot resource group

    rgId=$(az group show --name arc_pilot --query id --output tsv)
  2. Create a service principal with the Azure Connected Machine Onboarding role

    az ad sp create-for-rbac --name arc_pilot --role "Azure Connected Machine Onboarding" --scopes $rgId

    ⚠️ Make sure that you take a copy of the JSON output as it includes the clientId/appId and the clientSecret/password.

    The portal will look for service principals with the Azure Connected Machine Onboarding role when generating scripts.

Script generation

⚠️ Challenge: Create PowerShell and Bash onboarding scripts.

  • Provide a generated script that can be executed on multiple servers

  • Onboard into the arc_pilot resource group and the West Europe region

  • Include the following tags:

    Tag Value
    platform VMware vSphere
    cluster POC

    If you are using a non-Azure platform for your on prem VMs then feel free to change the tag values.

  • Ensure the script uses the service principal that you’ve just created

    💡 Hint 1: Add a shebang as the first line in the generated Bash script, e.g.:

    #!/usr/bin/env bash

    💡 Hint 2: Lost the service principal secret already? Rerun the az ad sp create-for-rbac command.

Success criteria

Screen share with your proctor to show your

  1. PowerShell script
  2. Bash script



In the next lab you will onboard a few of the VMs.

Help us improve

Azure Citadel is a community site built on GitHub, please contribute and send a pull request

 Make a change