When Your IT or Security Organization Has Restrictions on Use of Azure Marketplace Offers or on Marketplace Purchases in the Horizon Cloud on Microsoft Azure Deployment's Subscription or When the Deployment Uses Azure China

This documentation page describes requirements related to Horizon Cloud on Microsoft Azure use of Azure Marketplace for the deployment and upgrade processes, and when your support request requires Horizon Cloud Support to deploy a troubleshooting jump box.

This information pertains to you if you or your IT or security organization have set restrictions in the Horizon Cloud on Microsoft Azure deployment's subscriptions around use of Azure Marketplace offers or Azure Marketplace ordering.

Also, if you have a Horizon Cloud on Microsoft Azure deployment in Azure China, you might need Horizon Cloud Support team's assistance, as described in this page's section Deployments in Azure China.

Brief Introduction

Starting in early calendar year 2022, the service enhanced the Horizon Cloud on Microsoft Azure deployer and upgrade code for programmatic use of offers that we provide in the Azure Marketplace.

This enhancement makes the initial deployment process and upgrade process run faster, to achieve near zero-downtime upgrades of the pod manager instances and Unified Access Gateway instances.

This enhancement also provides for running deployments and upgrades without using additional storage accounts beyond the one storage account used for the App Volumes feature.

Relationship of Azure Marketplace to Deployments, Upgrades, and the Support Jump Box

During the deployment and upgrade processes, the deployer and upgrade code programmatically attempts by API call to accept the terms of Horizon Cloud offers in Azure Marketplace that correspond to the publisherID named omnissallc.

Related Entity	publisherID	offerID	planID
pod manager	omnissallc	omnissa-hcs-podmgr	omnissa-hcs-podmgr
Unified Access Gateway	omnissallc	omnissa-hcs-uag	omnissa-hcs-uag
jump box, when needed by Horizon Cloud Support for troubleshooting circumstances	omnissallc	omnissa-hcs-jumpbox	omnissa-hcs-jumpbox

Note: Using the Azure Portal to view these offers by navigating to the Azure Marketplace is unsupported. Horizon Cloud publishes these offers for programmatic access using API calls.

The Service's API Call Requirements

Success of this programmatic method requires the Horizon Cloud on Microsoft Azure deployment's Azure subscriptions to meet the requirements described in the following sections.

Those items provide for the deployer and upgrade API calls to accept the terms of Horizon Cloud offers in Azure Marketplace that correspond to the service's publisherID, offerID, and planID as listed in the preceding table.

These requirements apply to both the subscriptions used by the pod manager instances and for subscriptions used by the Unified Access Gateway instances when deployed in their own subscription.

If the following items are unmet in the Azure subscription, the deployer and upgrade code's API calls to accept the offer terms will fail, resulting in:

New deployment failures involving that subscription.
Upgrade failures for pod manager and Unified Access Gateway instances already deployed in that subscription.
Failure to deploy the troubleshooting jump box into that subscription if needed by Horizon Cloud Support to troubleshoot your support requests.

One special situation is the scenario of a Horizon Cloud on Microsoft Azure deployment located in Azure China. In Azure China, Microsoft does not provide the Microsoft.Marketplace.Ordering resource type that the service's API calls need. If your Horizon Cloud on Microsoft Azure deployment resides in Azure China, read the guidance in the section Azure China - Special Considerations.

Requirement When the Deployment's Service Principals Use Custom Roles

When using a custom role as described here, the following permissions must be included in the custom roles:


Microsoft.MarketplaceOrdering/offertypes/publishers/offers/plans/agreements/read
Microsoft.MarketplaceOrdering/offertypes/publishers/offers/plans/agreements/write

For new deployments of the pod manager instances or Unified Access Gateway instances, the UI's deployment wizards validate whether the service principal has those permissions in the subscription. If that validation fails, the UI prevents starting the deployment.
For upgrades, the system pre-checks attempt to confirm whether the service principal has those permissions in the subscription. If missing, the pre-checks report an update-blocking error. The remedy is to include those permissions in the custom role.
If Horizon Cloud Support needs to deploy the for-troubleshooting jump box to respond to your support request, the jump box deployment process will indicate to Horizon Cloud Support that the permissions are missing.

In this scenario, Horizon Cloud Support will see error messages logged in a pattern such as Could not proceed with upgrade as configured subscription has insufficient read permission to use marketplace image offers. Could not proceed with upgrade as configured subscription has insufficient write permission to use marketplace image offers.

Requirement When an Azure Policy Restricts the Azure Resource Types Allowed in the Subscriptions

Some IT organization's Azure Policy might specify to disallow all use of Azure resource types except for specific resource types explicitly allowed by name.

When your IT or security organization has set such an Azure Policy which restricts the types of Azure resource types allowed in the organization's Azure subscriptions, the Azure Policy's AllowedResourceTypes set must include allowing for the resource type Microsoft.MarketplaceOrdering/*.

If the subscription's Azure Policy does not include Microsoft.MarketplaceOrdering/*, Horizon Cloud Support will see error messages logged in a pattern such as Offer with PublisherId: 'omnissallc', OfferId: 'omnissa-hcs-xxxxx' cannot be purchased due to validation errors. Sku 'omnissa-hcs-xxxxxx' of offer 'omnissa-hcs-xxxxxx' by publisher 'omnissallc' is not available to you for deployment per the policy set by your IT Admin, where xxxxx corresponds to one of the planIDs in the preceding table.

Allowing access to the Microsoft.MarketplaceOrdering/* resource type allows the deployer and upgrade code to make the API calls to accept the Horizon Cloud on Microsoft Azure offers in Azure Marketplace that the deployer and upgrade code use.

If your IT or security team refuses to allow for this resource type in the subscription, they can use the option to add the Horizon Cloud offer SKUs to the enterprise's Azure Private Store by performing the actions described in the section Add the Offers to the Enterprise's Azure Private Store Collection. Then the service's API calls can obtain the offers from there.

Requirement When Your Enterprise Admin Has Switched Off Azure Marketplace Purchasing for Their Azure Enterprise Tenant

As described in the Microsoft Azure documentation, enterprise administrators can switch off Azure Marketplace purchasing for all of the Azure subscriptions under their enterprise Azure tenant.

When they do that, it limits Azure Marketplace purchasing to offers from the Microsoft publisher. This limited purchasing blocks the service's API calls to fetch the Horizon Cloud offers from the omnissallc publisherID, and as a result, prevents the deployment and upgrade process that require those API calls.

In this scenario, Horizon Cloud Support will see error message logged in a pattern such as Cannot complete purchase as your enrollment for this subscription doesn't allow purchase of marketplace paid products. Your Azure enrollment administrator can enable purchase of paid marketplace products..

The remedy for this situation is to request the enterprise admin create and manage a private Azure Marketplace collection and add the Horizon Cloud offers to it by performing the actions in the following section Add the Offers to the Enterprise's Azure Private Store Collection.

Add the Offers to the Enterprise's Azure Private Store Collection

Microsoft Azure provides the ability to create and manage a private Azure Marketplace collection for use by your subscriptions. As described in create and manage a Private Azure Marketplace, this feature lets IT administrators pre-approve, curate, and control which third-party solutions their users can use from the global Azure Marketplace. As described in the Microsoft documentation page linked in the previous sentence, the Marketplace admin role must be assigned to the admin who will manage the private store.

Once the private store is created for the enterprise Azure tenant, the admin with the Marketplace admin role can add the offers to the private store collection. Adding the offers to the tenant's private store provides for the service's API calls to obtain those offers used for deployments and upgrades.

Microsoft provides PowerShell commands for the purpose of adding specific publisher offers to a private store collection.

Follow the Microsoft documentation reference for the prerequisites for running the PowerShell commands at Add an offer to a private marketplace. That Microsoft page also describes the PowerShell commands that Microsoft provides for this purpose.

The following example illustrates the Microsoft PowerShell commands to use to add the Horizon Cloud offers to that private store after the prerequisites for running the commands are met. First Get-AzMarketplacePrivateStore is used to obtain the Azure tenant's privateStoreId. Then Set-AzMarketplacePrivateStoreOffer is used to add the Horizon Cloud offers to that private store.


Get-AzMarketplacePrivateStore

Use Get-AzMarketplacePrivateStore to obtain the Azure tenant's privateStoreId to use in the next set of commands.
```
Get-AzMarketplacePrivateStore
```

Use the returned privateStoreId in the Set-AzMarketplacePrivateStoreOffer commands to add in turn the offers for omnissa-hcs-podmgr, omnissa-hcs-uag, and omnissa-hcs-jumpbox.

Add the offer for the pod manager instances:


Set-AzMarketplacePrivateStoreOffer -privateStoreId your-tenant-privateStoreID -offerId omnissallc.omnissa-hcs-podmgr -SpecificPlanIdsLimitation @("omnissa-hcs-podmgr")

Add the offer for the Unified Access Gateway instances:


Set-AzMarketplacePrivateStoreOffer -privateStoreId your-tenant-privateStoreID -offerId omnissallc.omnissa-hcs-uag -SpecificPlanIdsLimitation @("omnissa-hcs-uag")

Add the offer for the for-troubleshooting jump box instance:


Set-AzMarketplacePrivateStoreOffer -privateStoreId your-tenant-privateStoreID -offerId omnissallc.omnissa-hcs-jumpbox -SpecificPlanIdsLimitation @("omnissa-hcs-jumpbox")

Verify if the offers are now listed in the tenant's private store.


Get-AzMarketplacePrivateStoreOffer -PrivateStoreId your-tenant-privateStoreID

Azure China - Special Considerations

Because Microsoft does not provide the Microsoft.Marketplace.Ordering resource type in Azure China, the service's features that use API calls to Horizon Cloud's offers in Azure Marketplace cannot be supported. The Microsoft.Marketplace.Orderingtype is not listed in this Microsoft documentation reference for Azure China resource providers.

Therefore, keep in mind these special considerations when you are using a subscription in Azure China for a Horizon Cloud on Microsoft Azure deployment.

For an existing Horizon Cloud on Microsoft Azure deployment in Azure China, before upgrading that deployment, obtain support from Horizon Cloud Support to configure your Horizon Cloud tenant to use the prior upgrade method, without API calls to the Azure Marketplace.
When you plan a deployment into Azure China, before beginning that deployment, obtain support from Horizon Cloud Support to configure your Horizon Cloud tenant so that the deployer uses the prior deployment method, without API calls to the Azure Marketplace.
If Horizon Cloud Support needs to deploy a temporary jump box for troubleshooting a deployment located in Azure China, Horizon Cloud Support can temporarily configure the Horizon Cloud tenant to enable the capability to deploy the temporary jump box into the subscription without the service's API calls to the Azure Marketplace. After the temporary jump box is deployed for troubleshooting, Horizon Cloud Support can re-enable the capability for the service's API calls, in case the tenant has pods deployed in subscriptions located in regions in addition to Azure China.

Deployments and upgrades without use of the Azure Marketplace take longer to complete. Also, such deployments and upgrades will require use of the temporary jump box to orchestrate the deployment and upgrade processes and use of storage accounts in the subscription to hold the images that the service's API calls will retrieve from the Horizon Cloud control plane instead of using the Horizon Cloud offers in the Azure Marketplace.

Was this page helpful?