---
title: "Prerequisites for the Azure Public Cloud and MarketPlace Deployments"
canonical: "https://docs.infoblox.com/space/vniosazure/37814511/Prerequisites%20for%20the%20Azure%20Public%20Cloud%20and%20MarketPlace%20Deployments"
format: markdown
---
<span style="color: #000000">Before you deploy a vNIOS for Azure appliance in Azure public cloud or through the MarketPlace, ensure that your setup meets the requirements described in this topic.</span>

# Common Prerequisites

- <span style="color: #000000">Set up a Microsoft Azure account and create a resource manager in Azure public cloud. You will use the resource manager to </span>  
manage resources and share them across Azure accounts, organizational units and with IAM roles and users.
- <span style="color: #000000">Install and set up an Azure command line interface (CLI) as described in the </span><span style="color: #000000">*Installing the Azure CLI*</span><span style="color: #000000"> section. This is required to deploy the vNIOS appliance from the Azure CLI.</span>
- <span style="color: #000000">Configure an on-prem Infoblox Grid or Grid Master. This is required only if you want to join the vNIOS for Azure instance to the on-prem Grid. For more information, refer to the</span> [Infoblox Documentation Portal](https://docs.infoblox.com/space/NIOS/35400616/NIOS).
- <span style="color: #000000">Create an Azure managed disk from the Azure CLI. For the command to create a managed disk, see </span>*[Deploying the vNIOS Instance on a Managed Disk on Azure Public Cloud](https://infoblox-docs.atlassian.net/wiki/spaces/vniosazure/pages/37487020)* or *[Deploying the vNIOS Instance with High Availability](https://infoblox-docs.atlassian.net/wiki/spaces/vniosazure/pages/636026896)*<span style="color: #000000">.</span>  
<span style="color: #000000">Azure virtual appliances can be deployed with managed disks from NIOS 8.6.x onwards. From NIOS 9.0.1 onwards, they can be deployed only with managed disks.</span>

# Prerequisites for HA Deployment

To deploy vNIOS for Azure instances in an HA (high availability) setup, a capability available from NIOS 9.0.4 onwards, complete the prerequisites listed in the *Common Prerequisites* section, and then the HA specific requirements listed in this section.

- In the Microsoft Azure portal, complete the following steps:
  - Create a custom role as described in the *[Creating a Custom Role in Azure](#Create_Azure_Custom_Role)* section.  
You need to assign the custom role to user-assigned or system-assigned managed identity that you will attach to the vNIOS instance when deploying it.
  - For a vNIOS instance that runs on NIOS version 9.0.4 or 9.0.5: create a user-assigned managed identity as described in the *[Creating an User-Assigned Managed Identity](#Create_User_Managed_Identity)* section.  
For a vNIOS instance that runs on NIOS 9.0.6 or later: You can create a system-assigned managed identity when deploying the instance.  
For more information about Azure managed identities, see *[Azure Managed Identity Requirements](#Azure_Managed_Identities)*.
- In NIOS, configure a DNS resolver in the *Grid Properties Editor*. For more information about DNS resolvers, refer to the *Enabling DNS Resolution* topic in the [Infoblox Documentation Portal](https://docs.infoblox.com/space/NIOS/35400616/NIOS).  
The resolver must be able to reach the following cloud APIs:
  - management.azure.com
  - login.microsoftonline.com
    

# <span style="color: #000000">Installing the Azure CLI</span>

<span style="color: #000000">To deploy a vNIOS appliance from the Azure CLI, you must install and set up the Azure CLI. To install, complete the following steps:</span>

1. <span style="color: #000000">Install the Azure CLI. For instructions, see </span>*[Install the Azure CLI on Linux manually](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli)*.
2. Verify whether the installation was successful by running the following command:  
`az --version`
3. <span style="color: #000000">Run the </span>`az login`<span style="color: #000000"> command to generate an authentication code required to access the Azure public cloud environment.</span>
4. <span style="color: #000000">In a browser window, log in to</span> *[https://microsoft.com/devicelogin](https://microsoft.com/devicelogin)*<span style="color: #000000"> using the authentication code that is generated by running the </span>`az login`<span style="color: #000000"> command.</span>

# > Macro (anchor)

Creating a Custom Role in Azure

Create a custom role in Azure specifying the permissions listed in this section. These permissions are a minimum requirement for VM instances to manage resources in Azure cloud. For detailed instructions, refer to the Azure documentation.

To create a custom role from the Azure portal, complete the following steps:

1. Sign in to the Microsoft Azure portal.
2. Under **Services**, click **Resource groups**.
3. On the *Resource groups* page, open your resource group on which you want the role to be assignable.
4. Click **Access control (IAM)**.
5. In the **Add** drop-down list, select **Add custom role**.
6. In the *Create a custom* role panel:
  1. On the **Basics** tab, specify a name and a description, and retain the **Baseline permissions** as **Start from scratch**. Click **Next**.
  2. On the **JSON** tab, to update the JSON script that displays, click the **Edit** button and add the required permissions in the `actions` properties list.
    - Copy only the permissions from the below sample JSON script. If you copy the entire JSON script from the sample, some values such as the subscription ID are not automatically retrieved and you have to enter them manually.
    - The permissions included in the sample JSON script, is a minimum requirement to allow a VM instance to manage resources in the Azure cloud. You may add more permissions to the role, but Infoblox recommends that you do not remove any permission from the required list.
      `{`  
`   "id": "/subscriptions/<automatically_retrieved_subscription_id>/providers/Microsoft.Authorization/roleDefinitions/3fe1ef8a-86f3-452a-99ba-7be482b33e34",`  
`   "properties": {`  
`       "roleName": "Custom Network Role",`  
`       "description": "Custom role for network operations",`  
`       "assignableScopes": [`  
`           "/subscriptions/<automatically_retrieved_subscription_id>"`  
`       ],`  
`       "permissions": [`  
`           {`  
`               "actions": [`  
`                   "Microsoft.Network/networkInterfaces/read",`  
`                   "Microsoft.Network/networkInterfaces/write",`  
`                   "Microsoft.Network/virtualNetworks/read",`  
`                   "Microsoft.Network/virtualNetworks/write",`  
`                   "Microsoft.Network/virtualNetworks/delete",`  
`                   "Microsoft.Network/networkInterfaces/delete",`  
`                   "Microsoft.Network/networkSecurityGroups/join/action",`  
`                   "Microsoft.Network/virtualNetworks/subnets/join/action",`  
`                   "Microsoft.Authorization/roleDefinitions/read",`  
`                   "Microsoft.ManagedIdentity/userAssignedIdentities/read",`  
`                   "Microsoft.Authorization/roleAssignments/read",`  
`                   "Microsoft.Compute/virtualMachines/read"`  
`               ],`  
`               "notActions": [],`  
`               "dataActions": [],`  
`               "notDataActions": []`  
`           }`  
`       ]`  
`   }`  
`}`
    - NIOS uses the roles with read permissions to run a check and validate the configuration on the host.
    - NIOS uses the roles with write permissions to unassign and assign private and public IP addresses during an HA failover. The following permissions provide write access:
      - `Microsoft.Network/networkSecurityGroups/join/action`: This permission is required to associate the network security group configured on the host with the secondary IP address assigned to the HA interface.
      - `Microsoft.Network/virtualNetworks/subnets/join/action`: This permission is required to associate the configured subnet with the secondary IP address assigned to the HA interface.
      - `Microsoft.Network.virtualNetworks.delete` and `Microsoft.Network.virtualNetworks.write`: These are parent level permissions required to manage the underlying network resources such as virtual networks and subnets.
      - `Microsoft.Network.networkInterfaces.delete`: This permission is required to unassign private IP addresses from network interfaces during an HA failover.
      - `Microsoft.Network.networkInterfaces.write`: This permission is required to assign private IP addresses to network interfaces during an HA failover.
    - If you intend to use a public IP address to access the HA Grid from outside of your private virtual network, include the following role permissions to the minimum set of permissions listed in the JSON script:  
`"Microsoft.Network/publicIPAddresses/write",`  
`"Microsoft.Network/publicIPAddresses/delete",c`  
`"Microsoft.Network/publicIPAddresses/join/action"`  
`"Microsoft.Network/publicIPAddresses/read"`  
  
The permissions provide the following accesses:
      - `Microsoft.Network/publicIPAddresses/write`: The permission associates the configured public IP address with the private IP address.
      - `Microsoft.Network/publicIPAddresses/delete`: The permission disassociates the configured public IP address from the private IP address.
      - `"Microsoft.Network/publicIPAddresses/join/action"`:  The permission allows a resource to associate (join) itself with a public IP address
      - `"Microsoft.Network/publicIPAddresses/read"`: The permission allows NIOS to read the public IP address associated with a network interface.
  3. Click **Save** and then click **Review + create**.
7. Click **Create**.

> ⚠️ **Note**
> ⚠️ 
> ⚠️ Starting from NIOS 9.0.7, permissions `Microsoft.Network/virtualNetworks/delete` and `Microsoft.Network/virtualNetworks/write` are not required to form HA. You can remove them from the role. However, they are required if the vNIOS appliance is running on NIOS 9.0.6 or a prior version that supports HA.

# > Macro (anchor)

> Macro (anchor)

Azure Managed Identity Requirements

Azure supports user-assigned and system-assigned managed identity types. A user-assigned managed identity can be created as a prerequisite and assigned to multiple instances when deploying them, whereas a system-assigned managed identity is instance specific and so, it is created and assigned to an instance when deploying the instance.

According to the version of NIOS that is running on a VM instance, consider the following guidelines:

- NIOS versions 9.0.6 and later:
  - Infoblox recommends that you use system-assigned managed identity although both user-assigned and system-assigned managed identity types are supported.
    - To use multiple user-assigned managed identities, you must attach the vNIOS instance with a system-assigned managed identity that is assigned with minimum permissions defined in the *Creating a Custom Role in Azure* section, along with other managed identities.
    - To use user-assigned managed identity, you must attach a vNIOS instance with one user-assigned managed identity only.  
You can achieve this by individually assigning the same managed identity to both node1 and node2.
  - You can assign a managed identity with multiple roles of which one of them must have the minimum permissions defined in the *Creating a Custom Role in Azure* section, along with other roles.
  - If you upgrade from NIOS 9.0.4 or 9.0.5 to 9.0.6 or later, you can continue to use the single user-assigned managed identity or configure a system-assigned managed identity as described above to use multiple user-managed identities.
- NIOS versions 9.0.4 and 9.0.5:
  - Supports only the user-assigned managed identity type. System-assigned managed identity is not supported.
  - You must attach only one user-assigned managed identity per instance. You can achieve this by individually assigning the same managed identity to both node1 and node2. Configuring multiple managed identities on an instance is not supported.
  - If you want to assign multiple roles to a user-assigned managed identity, ensure that the role that has the minimum permissions defined in the *Creating a Custom Role* section is located as the first role in the hierarchy. Otherwise, assigning multiple roles is not supported.

## Creating an User-Assigned Managed Identity

Create a user-assigned managed identity and assign the custom role that you created with permissions needed for a VM to access the resources in Azure cloud.

In the Azure portal, complete the following steps:

1. In the Microsoft Azure portal, under **Services**, click **Managed Identities**.
2. On the *Managed Identities* page, click **Create**.
3. In the *Create User Assigned Managed Identity* panel, complete the following:
  - **Subscription**: Choose your subscription in which you want this identity created.
  - **Resource **group: Choose the resource group in which you need to create this identity.
  - **Region**: Choose a region to deploy this managed identity.
  - **Name**: Specify a name for this managed identity.
4. Click **Review + create **> **Create**.
5. Configure the Azure role assignment:
  1. Open the user-assigned managed identity you created.
  2. Click **Azure role assignments** > **Add role assignment (Preview)**.
  3. In the *Add role assignment (Preview)* panel:
    1. **Scope**: Choose one of the following resource types:  
Note: The scope that you select displays under **Resource Type** after the role assignment is saved.
      - **Subscription**: Defining **Subscription** as the scope allows the managed identity to access all resources and/or resources groups in the subscription. Choose your subscription from the **Subscription** drop-down list.
      - **Resource Group**: Defining **Resource Group** as the scope allows the managed identity to access only the resource groups in the subscription.  
Complete the following:
        - **Subscription**: Choose your subscription from the drop-down list.
        - **Resource Group**: Select the resource group that this managed identity must access.
    2. **Role**: Choose the custom role that you created to assign it to the managed identity.
    3. Click **Save**.

For more information about managed identities and custom roles, refer to *[Managed identities for Azure resources](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview)* and *[Role-based access control](https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles-cli)* respectively.