Azure Local Cluster Validation failing at Evaluate interface ValidateArcIntegration step

Question

Azure Local Cluster Validation failing at Evaluate interface ValidateArcIntegration step

Lavanya Roy 66

Hi,

I have a two-node azure local cluster but I am running into validation issues with it - This is the exact error message -

Type 'ValidateArcIntegration' of Role 'EnvironmentValidator' raised an exception: { "ExceptionType": "text", "ErrorMessage": "The provided account MSI@50342 does not have access to subscription ID "xxx-xxx-xxx-xxx". Please try logging in with different credentials or a different subscription ID. If a subscription is not specified, please check the configs by Get-AzConfig.", "ExceptionStackTrace": "at Invoke-AzStackHciArcIntegrationValidation, C:\Program Files\WindowsPowerShell\Modules\AzStackHci.EnvironmentChecker\AzStackHciArcIntegration\AzStackHci.ArcIntegration.psm1: line 166\r\nat Test-AzStackHciArcIntegration, C:\Program Files\WindowsPowerShell\Modules\AzStackHci.EnvironmentChecker\AzStackHciArcIntegration\AzStackHciArcIntegration.psm1: line 136\r\nat \u003cScriptBlock\u003e, \u003cNo file\u003e: line 1\r\nat RunSingleValidator, C:\NugetStore\AzStackHci.EnvironmentChecker.Deploy.10.2505.0.2008\content\Classes\EnvironmentValidator\EnvironmentValidator.psm1: line 878\r\nat ValidateArcIntegration, C:\NugetStore\AzStackHci.EnvironmentChecker.Deploy.10.2505.0.2008\content\Classes\EnvironmentValidator\EnvironmentValidator.psm1: line 572\r\nat \u003cScriptBlock\u003e, C:\CloudDeployment\ECEngine\InvokeInterfaceInternal.psm1: line 157\r\nat Invoke-EceInterfaceInternal, C:\CloudDeployment\ECEngine\InvokeInterfaceInternal.psm1: line 152\r\nat \u003cScriptBlock\u003e, \u003cNo file\u003e: line 50" } at RunSingleValidator, C:\NugetStore\AzStackHci.EnvironmentChecker.Deploy.10.2505.0.2008\content\Classes\EnvironmentValidator\EnvironmentValidator.psm1: line 898 at ValidateArcIntegration, C:\NugetStore\AzStackHci.EnvironmentChecker.Deploy.10.2505.0.2008\content\Classes\EnvironmentValidator\EnvironmentValidator.psm1: line 572 at <ScriptBlock>, C:\CloudDeployment\ECEngine\InvokeInterfaceInternal.psm1: line 157 at Invoke-EceInterfaceInternal, C:\CloudDeployment\ECEngine\InvokeInterfaceInternal.psm1: line 152 at <ScriptBlock>, <No file>: line 50

It fails on The evaluate interface Validate Arc integration step.

Any idea what that MSI@50342 is? cannot find it under managed identities. For now I have given the Cluster MI and the Node MIs access to the subscription but still failing.

Any help would be appreciated!

Sudheer Reddy 2,075 Reputation points Moderator

2025-06-04T02:51:34.87+00:00

Hi Lavanya Roy,

From above, I understand that you are performing Environment Checker to assess how ready your environment is for deploying the Azure Local solution by executing the readiness module scripts inside PowerShell on each node.

Run Get-AzConfig (as suggested in the error) to confirm your Azure CLI or PowerShell session is set to the correct subscription and tenant. This ensures that commands and scripts are targeting the right environment.

While connecting, try to execute by adding -TenantId parameter as well to your command, Connect-AzAccount -TenantId xxxx -SubscriptionId xxxx https://github.com/Azure/azure-cli/issues/5402

Managed Service Identity (MSI) specifically a system-assigned managed identity associated with your Azure resource. https://stackoverflow.com/questions/71705246/cannot-login-to-azure-with-system-assigned-managed-identity-id

Plese check here for more information.

If the information is helpful, please click on "Upvote"

If you have any queries, please do let us know, we will help you.
Tonkso 0 Reputation points

2025-06-11T14:46:17.0533333+00:00

Hi, I am getting the same error when trying to run validation, before deployment, of Azure Local. I have tried using the Azure Arc portal, or using an ARM template. Similarly this is 2 nodes. I have ran local validation tools and it passes with out issue. I have tried to clean up resource group, removing everything but the two physical ARC servers and starting again, but still get the same error.

I have checked permissions on my account, used for deployment, but I don't think it is the issue. Seems to be the managed identity referred to by MSI@50342 is missing permissions. I tried adding permissions for all managed identity within the resource group for the Azure Local deployment, but still same error.

Type 'ValidateArcIntegration' of Role 'EnvironmentValidator' raised an exception: { "ExceptionType": "text", "ErrorMessage": "The provided account MSI@50342 does not have access to subscription ID "--------------". Please try logging in with different credentials or a different subscription ID. If a subscription is not specified, please check the configs by Get-AzConfig.", "ExceptionStackTrace"

Any assistance appreciated.

Thank you
Surendra Pullagura (MSC Technology North America) 0 Reputation points

2025-06-26T23:30:30.7366667+00:00

I am also getting same error
Felippe Borges 96 Reputation points

2025-07-04T12:49:27.63+00:00

Hello all,

I'm facing the same issue. Did you solve your problem?

2 answers

Your answer

Sudheer Reddy 2,075 Reputation points Moderator

2025-06-04T02:51:34.87+00:00

Hi Lavanya Roy,

From above, I understand that you are performing Environment Checker to assess how ready your environment is for deploying the Azure Local solution by executing the readiness module scripts inside PowerShell on each node.

Run Get-AzConfig (as suggested in the error) to confirm your Azure CLI or PowerShell session is set to the correct subscription and tenant. This ensures that commands and scripts are targeting the right environment.

While connecting, try to execute by adding -TenantId parameter as well to your command, Connect-AzAccount -TenantId xxxx -SubscriptionId xxxx https://github.com/Azure/azure-cli/issues/5402

Managed Service Identity (MSI) specifically a system-assigned managed identity associated with your Azure resource. https://stackoverflow.com/questions/71705246/cannot-login-to-azure-with-system-assigned-managed-identity-id

Plese check here for more information.

If the information is helpful, please click on "Upvote"

If you have any queries, please do let us know, we will help you.
Tonkso 0 Reputation points

2025-06-11T14:46:17.0533333+00:00

Hi, I am getting the same error when trying to run validation, before deployment, of Azure Local. I have tried using the Azure Arc portal, or using an ARM template. Similarly this is 2 nodes. I have ran local validation tools and it passes with out issue. I have tried to clean up resource group, removing everything but the two physical ARC servers and starting again, but still get the same error.

I have checked permissions on my account, used for deployment, but I don't think it is the issue. Seems to be the managed identity referred to by MSI@50342 is missing permissions. I tried adding permissions for all managed identity within the resource group for the Azure Local deployment, but still same error.

Type 'ValidateArcIntegration' of Role 'EnvironmentValidator' raised an exception: { "ExceptionType": "text", "ErrorMessage": "The provided account MSI@50342 does not have access to subscription ID "--------------". Please try logging in with different credentials or a different subscription ID. If a subscription is not specified, please check the configs by Get-AzConfig.", "ExceptionStackTrace"

Any assistance appreciated.

Thank you
Surendra Pullagura (MSC Technology North America) 0 Reputation points

2025-06-26T23:30:30.7366667+00:00

I am also getting same error
Felippe Borges 96 Reputation points

2025-07-04T12:49:27.63+00:00

Hello all,

I'm facing the same issue. Did you solve your problem?

Answer 1

Pieter Teeling 30

The issue is the version of the az.accounts powershell module. If you're running anything but 4.0.2, you'll run into this scenario.
Start by checking the version of the module (Get-InstalledModule -Name Az.Accounts) and see if you're running 4.0.2 or anything else.

If you have 4.0.2 and other versions, delete the rest (without notification)
Get-InstalledModule -Name Az.Accounts -AllVersions -ErrorAction SilentlyContinue | Where-Object { $.Version -ne '4.0.2' } | ForEach-Object { Uninstall-Module -Name $.Name -RequiredVersion $_.Version -Force -ErrorAction SilentlyContinue }.

If 4.0.2 is missing:
Install-Module -Name Az.Accounts -RequiredVersion "4.0.2" -Force -AllowClobber -SkipPublisherCheck

Do this on all your nodes/machines.

Doing this will make the Azure Stack HCI Arc Integration step during the cluster validation of Azure Local continue without the errors you've seen before.

Pieter Teeling 30 Reputation points

2025-06-13T18:49:38.6133333+00:00

you may also have to check Az.Resources PowerShell module and make sure that's the 7.8.0 version
Tonkso 0 Reputation points

2025-06-16T11:50:21.7033333+00:00

Thank you very much Pieter!

This indeed was the answer and my cluster has now passed the validation stage.
I did not notice your other comment about Az.Resources until now, so at the time I ran with version 6.0.1 of that module (as it complained about version 8)
For anyone else with this issue, this was the windows build and modules I used:

WindowsProductName Azure Stack HCI
WindowsVersion 2009
OsBuildNumber 26100

Powershell modules installed:
Az.Accounts 4.0.2
Az.ConnectedMachine 1.1.1
Az.Resources 6.0.1
Az.Storage 8.1.0
PackageManagement 1.4.8.1
PowerShellGet 2.2.5
GabeCz 26 Reputation points

2025-06-30T11:39:15.0233333+00:00

validation passes with az.resources and az.accounts version mentioned above but deployment fails. unfortunately i did not take a note where it failed at first try with these versions. but upgrading them at or before joining the domain while deploying will result in the "MSI@50342" error. leaving it be will fail at a later step.

trusting that a system will work fine in a production environment without safety net that cannot be set up in a lab environment to test and learn is very difficult if not impossible.

so if i do not update before step "Register with Azure" it will say the versions of az.accounts and az.resources aren't the latest ones and errors out. if i update them to the latest i get the msi error above.

any solution yet?
Minh Tran Quang 0 Reputation points

2025-08-08T04:20:29.89+00:00

@Pieter Teeling You are my lifesaver!!!!!! Thanks a lot!!!!!!!!!!
Setua, Chiitaranjan 25 Reputation points

2025-10-14T11:08:10.91+00:00

Although i checked all the Module version and uninstalled but still its not working.

Error Mesage-Exception caught in Test-AzStackHciArcIntegration validator.
Setua, Chiitaranjan 25 Reputation points

2025-10-14T11:13:18.6166667+00:00

When we are try to update the date was 9th Oct and MS having some issue on that day. thats why its happening due to corrupt package ?

Answer 2

We just hit this same issue this evening.

However, just removing the version 5.5.0 of the Az.Accounts module and installing version 4.0.2 on the seed node will not work. If you leave the version of 10.0.0 Az.Resources module, you will get an error from the Azure Portal during verification steps that you need to run version 5.5.0 of the Az.Accounts module.

What we did under the guidance of Azure Support was to remove all versions of the Az.Accounts and Az.Resources modules from all nodes in the cluster. Then we installed version 4.0.2 of the Az.Accounts module and version 7.8.0 of the Az.Resources module on all nodes in the cluster. Verification was successful after performing these actions.

Share via

Azure Local Cluster Validation failing at Evaluate interface ValidateArcIntegration step

2 answers

Your answer