Ensure that your Microsoft Azure Edge deployment meets the requirements related to the service's use of Azure Marketplace.
This information applies if you or your IT or security organization have set restrictions in your deployment's Microsoft Azure subscriptions around use of Azure Marketplace offers or Azure Marketplace ordering.
To reduce deployment time, deployments of the Edge Gateway and Unified Access Gateway instances require use of offers that we provide in the Azure Marketplace. Note that the service's use of Azure Marketplace for Microsoft Azure Edge deployments is only available for Edge VM-based deployments, not AKS-based deployments.
Relationship of Azure Marketplace to Edge Deployments
The deployment code programmatically attempts by API call to accept the terms of Horizon Cloud offers in Azure Marketplace that correspond to the publisherID named omnissallc.
| Related Entity | publisherID | offerID | planID |
|---|---|---|---|
| Edge Gateway | omnissallc | horizon-edge-gw | byol_release |
| Unified Access Gateway | omnissallc | omnissa-hcs-uag | omnissa-hcs-uag-v2 |
Note: Using the Azure Portal to view these offers by navigating to the Azure Marketplace is unsupported. Horizon Cloud publishes these offers for programmatic access using API calls.
The API Call Requirements
Success of this programmatic method requires the Microsoft Azure Edge deployment's Azure subscriptions to meet the requirements described in the following sections.
These items provide for the deployer API calls to accept the terms of Horizon Cloud offers in Azure Marketplace that correspond to the service's publisherID, offerID, and planID as listed in the table above.
These requirements apply to the subscriptions used by the Edge Gateway and the Unified Access Gateway instances.
If the following items are unmet in the subscription, the deployer code's API calls to accept the offer terms will fail, resulting in deployment failures involving that subscription.
Requirement When the Deployment's Service Principals Use Custom Roles
When using a custom role, the following permissions must be included in the custom roles:
Microsoft.MarketplaceOrdering/offertypes/publishers/offers/plans/agreements/readMicrosoft.MarketplaceOrdering/offertypes/publishers/offers/plans/agreements/write
Requirement When an Azure Policy Restricts the Azure Resource Types Allowed in the Subscriptions
Some IT organization's Azure Policy might specify to disallow all use of Azure resource types except for specific resource types explicitly allowed by name.
When your IT or security organization has set such an Azure Policy which restricts the types of Azure resource types allowed in the organization's Azure subscriptions, the Azure Policy's AllowedResourceTypes set must include allowing for the resource type Microsoft.MarketplaceOrdering/*.
If the subscription's Azure Policy does not include Microsoft.MarketplaceOrdering/*, Horizon Cloud Support will see error messages logged in a pattern such as Offer with PublisherId: 'omnissallc', OfferId: 'omnissa-hcs-xxxxx' cannot be purchased due to validation errors. Sku 'omnissa-hcs-xxxxxx' of offer 'omnissa-hcs-xxxxxx' by publisher 'omnissallc' is not available to you for deployment per the policy set by your IT Admin, where xxxxx corresponds to one of the planIDs in the preceding table.
Allowing access to the Microsoft.MarketplaceOrdering/* resource type allows the deployer and upgrade code to make the API calls to accept the service's offers in Azure Marketplace that the deployer code uses.
If your IT or security team refuses to allow for this resource type in the subscription, they have an option to add the Horizon Cloud offer SKUs to the enterprise's Azure Private Store by performing the actions described in the section below Add the Offers to the Enterprise's Azure Private Store Collection. Then the service's API calls can obtain the offers from there.
Requirement When Your Enterprise Admin Has Switched Off Azure Marketplace Purchasing for Their Azure Enterprise Tenant
As described in the Microsoft Azure documentation, enterprise administrators can switch off Azure Marketplace purchasing for all of the Azure subscriptions under their enterprise Azure tenant.
When they do that, it limits Azure Marketplace purchasing to offers from the Microsoft publisher. This limited purchasing blocks the service's API calls to fetch the Horizon Cloud offers from the omnissallc publisherID and, as a result, prevents the deployment process that requires those API calls.
In this scenario, Horizon Cloud Support will see error message logged in a pattern such as Cannot complete purchase as your enrollment for this subscription doesn't allow purchase of marketplace paid products. Your Azure enrollment administrator can enable purchase of paid marketplace products.
The remedy for this situation is to request the enterprise admin create and manage a private Azure Marketplace collection and add the Horizon Cloud offers to it by performing the actions in the following section Add the Offers to the Enterprise's Azure Private Store Collection.
Add the Offers to the Enterprise's Azure Private Store Collection
Microsoft Azure provides the ability to create and manage a private Azure Marketplace collection for use by your subscriptions. As described in page Learn Microsoft - Govern and control using Private Azure Marketplace, this feature lets IT administrators pre-approve, curate, and control which third-party solutions their users can use from the global Azure Marketplace. As described in that page, the Marketplace admin role must be assigned to the admin who will manage the private store.
Once the private store is created for the enterprise Azure tenant, the admin with the Marketplace admin role can add the offers to the private store collection. Adding the offers to the tenant's private store provides for the service's API calls to obtain those offers used for deployments and upgrades.
Microsoft provides PowerShell commands for the purpose of adding specific publisher offers to a private store collection.
Follow the Microsoft documentation reference for the prerequisites for running the PowerShell commands described in Learn Microsoft - Add an offer to a private marketplace. That Microsoft page also includes the PowerShell commands that Microsoft provides for this purpose.
Example of Adding the Horizon Cloud Offers to an Azure Private Store
The following example illustrates the Microsoft PowerShell commands to use to add the Horizon Cloud offers to that private store after the prerequisites for running the commands are met.
-
First Get-AzMarketplacePrivateStore is used to obtain the Azure tenant's
privateStoreId. (Details in Microsoft doc Get-AzMarketplacePrivateStore) -
Then Set-AzMarketplacePrivateStoreOffer is used to add the Horizon Cloud offers to that private store. (Details in Microsoft doc Set-AzMarketplacePrivateStoreOffer)
In PowerShell:
- Obtain the Azure tenant's
privateStoreIdto use in the next set of commands.
Get-AzMarketplacePrivateStore
- Use the returned
privateStoreIdin the following commands to add the offers forhorizon-edge-gwandomnissa-hcs-uag.
- Add the offer for the Edge Gateway:
Set-AzMarketplacePrivateStoreOffer -privateStoreId your-tenant-privateStoreID -offerId omnissallc.horizon-edge-gw -SpecificPlanIdsLimitation @("byol_release")
- Add the offer for the Unified Access Gateway instances:
Set-AzMarketplacePrivateStoreOffer -privateStoreId your-tenant-privateStoreID -offerId omnissallc.omnissa-hcs-uag -SpecificPlanIdsLimitation @("omnissa-hcs-uag-v2")
- Verify if the offers are now listed in the tenant's private store.
Get-AzMarketplacePrivateStoreOffer -PrivateStoreId your-tenant-privateStoreID
Was this page helpful?