RegisterWithAzure.ps1 script failing

[aricbernard]

I've been trying to use the RegisterWithAzure.ps1 script.  The usage instructions are pretty clear, and I have followed them VERY closely.  However, my first attempt failed and therefore I assumed that the values for one or more of the parameters was specified incorrectly. I have now tried several variations and in turn have received multiple states of failure.

The current command line I am using is:
.\RegisterWithAzure.ps1 '
-azureSubscriptionId "" '
-azureSubscriptionOwner "" '
-azureDirectory ".onmicrosoft.com"

Due note that the azureSubscriptionOwner is NOT the AAD GLOBAL ADMIN ACCOUNT I used to install the Azure Stack.

The result of the script execution is the following followed by an error of the same nature

WARNING: Task: Invocation of interface 'ConfigureBridgeIdentity' of role 'Cloud\Fabric\AzureBridge' failed:

Function 'AzureBridge:ConfigureBridgeIdentity' in module 'Classes\AzureBridge\AzureBridge.psm1' raised an exception:

An error occurred while trying to make a graph API call: {"error":"invalid_grant","error_description":"AADSTS50034: To sign into this application the account must be added to
the aricbernardhotmail.onmicrosoft.com directory.\r\nTrace ID: 3dab2271-e97f-44e0-a7c6-d7d33a9a0198\r\nCorrelation ID: 4a9038f9-8fd5-49b2-932b-aa6002a3a1b0\r\nTimestamp: 2017-
03-03 04:07:23Z","error_codes":[50034],"timestamp":"2017-03-03 04:07:23Z","trace_id":"3dab2271-e97f-44e0-a7c6-d7d33a9a0198","correlation_id":"4a9038f9-8fd5-49b2-932b-aa6002a3a
1b0"}

Additional details: {
"Method": "POST",
"ResponseUri": "https://login.windows.net/aricbernardhotmail.onmicrosoft.com/oauth2/token?api-version=1.6",
"StatusCode": 400,
"StatusDescription": "Bad Request",
"IsFromCache": false,
"LastModified": "/Date(1488514044578)/"
}
at Invoke-GraphApi, C:\CloudDeployment\Roles\IdentityProvider\GraphAPI.psm1: line 515
at Get-GraphToken, C:\CloudDeployment\Roles\IdentityProvider\GraphAPI.psm1: line 375
at Update-GraphAccessToken, C:\CloudDeployment\Roles\IdentityProvider\GraphAPI.psm1: line 391
at Initialize-GraphEnvironment, C:\CloudDeployment\Roles\IdentityProvider\GraphAPI.psm1: line 219
at SetAzureBridgeIdentityConfiguration, C:\CloudDeployment\Roles\AzureBridge\AzureBridge.psm1: line 235
at ConfigureBridgeIdentity, C:\CloudDeployment\Classes\AzureBridge\AzureBridge.psm1: line 41
at , : line 9 - 3/2/2017 8:07:24 PM

[aricbernard]

If I use the same command line, but I set the azureSubscriptionOwner equal to the AAD GLOBAL ADMIN ACCOUNT I used to install the Azure Stack, I will proceed further into the script. However, if after entering those same credentials when prompted, the script will error out as follows:

Select-AzureRmSubscription : Provided subscription does not exist
At C:\temp\Registerwithazure.ps1:112 char:1

• Select-AzureRmSubscription -SubscriptionId $azureSubscriptionId

•   + CategoryInfo          : CloseError: (:) [Set-AzureRmContext], ArgumentException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.SetAzureRMContextCommand
  
  

Get-AzureRmResourceProvider : No subscription found in the context. Please ensure that the credentials you provided are authorized to access an Azure subscription, then run Login-AzureRMAccount to login.
At C:\temp\Registerwithazure.ps1:115 char:15

• ... egState = $(Get-AzureRmResourceProvider -ProviderNamespace 'microsoft ...

•             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : CloseError: (:) [Get-AzureRmResourceProvider], ApplicationException
  • FullyQualifiedErrorId : Microsoft.Azure.Commands.Providers.GetAzureProviderCmdlet

Cannot index into a null array.
At C:\temp\Registerwithazure.ps1:115 char:15

• ... egState = $(Get-AzureRmResourceProvider -ProviderNamespace 'microsoft ...

•             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: (:) [], RuntimeException
  • FullyQualifiedErrorId : NullArray

Get-AzureRmResourceProvider : No subscription found in the context. Please ensure that the credentials you provided are authorized to access an Azure subscription, then run Login-AzureRMAccount to login.
At C:\temp\Registerwithazure.ps1:119 char:19

• ... egState = $(Get-AzureRmResourceProvider -ProviderNamespace 'microsoft ...

•             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : CloseError: (:) [Get-AzureRmResourceProvider], ApplicationException
  • FullyQualifiedErrorId : Microsoft.Azure.Commands.Providers.GetAzureProviderCmdlet

Note that the last error above appears repeat indefinitely (or at least for much longer than I wish to sit and watch hoping it stops).

[aricbernard]

As if with the second scenario (above), if I use the same command line, but I set the azureSubscriptionOwner equal to the AAD GLOBAL ADMIN ACCOUNT I used to install the Azure Stack, I will proceed further into the script. However, if when prompted for credentials I instead use the Azure subscription owners credentials I can proceed even further into the script processing. Although eventually it does still error out with the following:

Select-AzureRmSubscription : Provided subscription does not exist
At C:\CloudDeployment\Setup\Activation\Bridge\Register-AzureStack.ps1:97 char:17

• ... scription = Select-AzureRmSubscription -SubscriptionId $SubscriptionI ...

•             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : CloseError: (:) [Set-AzureRmContext], ArgumentException
  • FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.SetAzureRMContextCommand

[MatthewMcGlynn]

Rupi, can you confirm that this issue is now fixed in the latest version of the registration script?

[rupisure]

Hi @aricbernard -- sorry, I am just seeing this. Did you eventually find success with the script?

The account specified as a parameter of the script needs to be a global admin of the aad tenant as well as a owner/contributor for the azure subscription. And the same account should be specified when prompted again in the script. (Can't use different creds in the second prompt) -- hope that helps!

[MatthewMcGlynn]

Closing. Feel free to reopen if an issue occurs again!