Deployment Issue: ApplianceDeploymentFailed'

[DAndries]

{'code':'DeploymentFailed','message':'At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.','details':[{'code':'ApplianceDeploymentFailed','message':'The operation to create appliance failed. Please check operations of deployment 'wkviyaapp' under resource group '/subscriptions/60eee668-4183-4cca-8230-822774c6a161/resourceGroups/mrg-sas-viya-on-azure-20230110125151'. Error message: 'At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.''}]}

Reviewing the resource group 'mrg-sas-viya-on-azure-20230110125151' I see mention of failed application deployment (wkviyaapp) and errors related to invalid access tokens. I also see an automation account (wk-viya-automation) created with failed attempt to create access keys.

The following is my response from MS support:
***

"code\":\"DeploymentScriptOperationFailed\",\"message\":\"The received access token is not valid: at least one of the claims 'puid' or 'altsecid' or 'oid' should be present. If you are accessing as application please make sure service principal is properly created in the tenant.\"

Judging from this, it seems the template for this managed appliction may be missing some required properties. That being said though, this managed application is a 3rd party offering. I do not know if you have had a chance to bring this to their attention, but the Sas Viya managed application has this link for support: https://communities.sas.com/t5/SAS-Viya-on-Microsoft-Azure/bd-p/viya-for-azure?utm_source=viya-azure...

I tried deploying it on my side so that I could review the template used for it, however the template in question simply calls a linked template using the following function: "[deployment().properties.templateLink.uri]". I suspect that the linked template in question has a Deployment Script resource that is tripping the aforementioned error, but this is speculation on my part as I am unable to view the linked template in question. 

***
Any help would be appreciated, TY

[rich_sas]

Hi @DAndries -

There are some requirements on your Azure subscription that must be true for our marketplace deployment to work. Could you please review the following documentation to make sure your subscription complies?

https://go.documentation.sas.com/doc/en/viyaakscdc/v_001/viyaaksfaq/n09skbpwwk7m4vn122eufqzw4mgr.htm...

We would like to be able to provide pre-flight checks / warnings for these issues but it's not currently possible for this type of marketplace deployment on Azure.

Please reply back if you continue to have issues.

Best regards,

Rich

[DAndries]

Hello @rich_sas,

Thanks for the response. In reply,

-Azure user account with suitable permissions:
My Azure account is a Global Administrator with rights to deploy from the marketplace.

-Service limits:
(Per my region of deployment)
Total Regional vCPUs: 64
I have thousands available.
Standard DSv4: 44
I have 50 available.
Standard EDSv4: 20
I have 25 available.

-The regions listed in Azure regions with availability zones are supported.
The region I am deploying to is South Cental US, which has availability zone support.

If this was based on a resource constraint typically it's accompanied by a "QuotaExceeded" message, I do not think it is the case. Since the errors lend themselves to access tokens and key creation, maybe it's possible the template is using some expired values now that we roll into 2023?

[rich_sas]

Thanks for the additional information. We are continuing to investigate your issue.

We have other customers successfully deploying at this time, so we do not believe that there is any issue with the install assets. Or, at least not a general error that impacts everyone.

Best regards,

Rich

[DAndries]

@rich_sas Well I tried this deployment again today with the same parameters and lo and behold the deployment succeeded. So I have no explanation, but at least I am past the issue. Thanks.

[rich_sas]

Good news, @DAndries! Thanks for your patience and perseverance. I'm not sure what changed but it must have been something spurious in the cloud environment.