The following roles must be added to the resource group that you use for the deployment. You can assign these roles using either PowerShell commands or Azure portal:

Key vault data access administrator
Key vault secrets officer
Key vault contributor
Storage account contributor
Azure connected machine onboarding
Azure connected machine resource administrator

Note: Each of these roles must be assigned only once.

Assign deployment user roles using PowerShell

Use PowerShell commands to assign deployment user roles.

To assign user roles with PowerShell, do the following:

On a management workstation, install the Azure PowerShell module using the following command:
```
Install-Module -Name Az -Repository PSGallery -Force 
			 
```
1. To authenticate to Azure and to connect, define the Subscription and Tenant ID. In the following example, the HCI Registration account is used.
2. Log in to Microsoft Device code, and then enter the code.
```
$Subscription = “<subscription ID>”
$Tenant = “<Tenant ID>”
Connect-AzAccount -SubscriptionId $Subscription -TenantId $Tenant -DeviceCode
```
To assign the roles and the Resource Group, define the user account using the following commands:
```
$ResourceGroup =”<resource group name>”
$SignInName = “<Azure sign in username>”
```

Assign the appropriate roles using the following commands:

New-AzRoleAssignment -SignInName $SignInName `
-RoleDefinitionName “Key Vault Data Access Administrator” `
-ResourceGroupName $ResourceGroup
 
New-AzRoleAssignment -SignInName $SignInName `
-RoleDefinitionName “Key Vault Secrets Officer” `
-ResourceGroupName $ResourceGroup
 
New-AzRoleAssignment -SignInName $SignInName `
-RoleDefinitionName “Key Vault Contributor” `
-ResourceGroupName $ResourceGroup
 
New-AzRoleAssignment -SignInName $SignInName `
-RoleDefinitionName “Storage Account Contributor” `
-ResourceGroupName $ResourceGroup

New-AzRoleAssignment -SignInName $SignInName `
-RoleDefinitionName “Azure Connected Machine Onboarding” `
-ResourceGroupName $ResourceGroup

New-AzRoleAssignment -SignInName $SignInName `
-RoleDefinitionName “Azure Connected Machine Resource Administrator” `
-ResourceGroupName $ResourceGroup

Assign deployment user roles using Azure portal

To use Azure portal for assigning permissions for deployment, see Assign required permissions for deployment.

Your Browser is Out of Date

Cluster deployment prerequisites

Cluster deployment prerequisites

Assign deployment user roles

Assign deployment user roles using PowerShell

Assign deployment user roles using Azure portal