AI assistants: this page is available as Markdown at http://0.0.0.0:4000/operate/azure-marketplace/step-2.md. The index of the whole documentation, with instructions for AI assistants, is at http://0.0.0.0:4000/llms.txt.

Pre-installation checklist

reference Facts, options, APIs

On this page

1. Check qualification
   1. Navigate to Billing Policies in Azure Portal
2. Check quota
3. Register resource providers
   1. Manual registration of resource providers
   2. Automatic registration of resource providers
   3. Verification script
4. Bring Your Own Private DNS Zones (Optional)
5. Configure network settings
   1. Define VNet
   2. Analyze CluedIn network configuration
6. Analyze Azure policies and tagging
7. Results
8. Next steps

In this article, you will learn about the pre-installation processes that you must perform to ensure successful installation of CluedIn PaaS.

Check qualification

As a Microsoft Azure Administrator, you should have expertise in implementing, managing, and monitoring your organization’s Microsoft Azure environment.

Because CluedIn will be installed in your Azure resource group, you need to be the Owner of that resource group or at least the Contributor to that resource group.

In addition, you should have permission to purchase paid applications from the Azure Marketplace. Set the permission to Free + Paid to complete the purchase registration in the Azure Marketplace.

Navigate to Billing Policies in Azure Portal

To access Policies for a specific billing tenant in the Azure Portal:

1. Open the Azure Portal.
2. In the left-hand navigation menu, go to Cost Management.
3. Click on Billing Profiles.
4. Select the appropriate Tenant from the list.
5. In the sidebar, choose Settings.
6. Under Settings, click on Policies.

Note: Ensure you have the appropriate permissions to view or modify billing policies. If you don’t see these options, verify your directory and tenant context in the portal.

To learn how to allow purchases, see Azure Marketplace purchasing.

Check quota

You should perform a quota check to make sure that your subscription has enough quotas for creating VMs required for CluedIn clusters. Each cluster will contain multiple nodes which are made up of virtual machines (VM).

There are 3 common VM family types that CluedIn will create as part of the AKS node pools. Your subscription must have enough spare vCPU quota to provision different nodes. For details on the quota for each VM, see the table below.

VM	Quota
System Pool (1 x Standard_DS2_v5)	At least 2 vCPUs in the Standard DSv5 Family vCPUs quota
General Pool (2 x Standard_D8s_v5)	At least 16 vCPUs in the Standard DSv5 Family vCPUs quota
Data Pool (2 x Standard D8as_v5)	At least 16 vCPUs in the Standard DASv5 Family vCPUs quota
Data Pool (1 x Standard D4as_v5)	At least 4 vCPUs in the Standard DASv5 Family vCPUs quota

In addition, check if you have enough quota for your plan.

Plan	Quota
Essential & PAYG	At least 8 vCPUs in the StandardDASv5Family quota
Professional	At least 16 vCPUs in the StandardDASv5Family quota
Elite	At least 32 vCPUs in the StandardDASv5Family quota

If you choose to deploy an optional management VM to access and administer the AKS cluster, ensure that your subscription has sufficient quota for the following VM.

VM	Quota
1 x Standard_B2as_v2	At least 2 vCPUs in the Standard B2asV2 Family vCPUs quota

And finally, ensure that the region you’re deploying to also has enough quota. This is called ‘Total Regional vCPUs’ in Azure and must be equal to or greater than the sum of all vCPUs being deployed.

You can check if you have enough quota by running a verification script.

If the quota is not available, then the installation will fail.

Register resource providers

Before using a resource provider, register your Azure subscription for that specific resource provider.

Make sure that the following resource providers are registered:

• Microsoft.Cache
• Microsoft.Capacity
• Microsoft.Compute
• Microsoft.ContainerService
• Microsoft.EventHub
• Microsoft.KeyVault
• Microsoft.ManagedIdentity
• Microsoft.Network
• Microsoft.OperationalInsights
• Microsoft.OperationsManagement
• Microsoft.Resources
• Microsoft.Storage
• Microsoft.Sql

You can register the resource providers in two ways: manually in the Azure portal and automatically by running a script.

After you register the resource providers, run the verification script to make sure that all resource providers are registered.

Manual registration of resource providers

This section contains the step-by-step procedure for manual registration of resource providers in the Azure portal.

To register resource providers

1. In the Azure portal, find and select the subscription where you need to install CluedIn.

   For more information about the subscription, see Get subscription and tenant IDs in the Azure portal.

2. On the left menu, under Settings, select Resource providers.

3. One by one, find and select the resource providers that you want to register, and then select Register.

   

   Wait until the status of the resource provider is changed from Registering to Registered.

   

4. Run the verification script to make sure that all resource providers are registered.

For more information about registering resource providers, see Azure documentation.

Automatic registration of resource providers

If you want a faster way to register the needed resource providers, run the script for automatic registration of resource providers.

Prerequisites

• PowerShell 7. We recommend installing PowerShell via Winget: winget search Microsoft.PowerShell. For more details, see Installing PowerShell on Windows.

• Azure CLI. We recommend installing Azure CLI via Winget: winget install -e --id Microsoft.AzureCLI. For more details, see Install Azure CLI on Windows.

• Your Azure subscription ID. For more details, see Find your Azure subscription.

To run the script for registering resource providers

1. Download this script.

2. Open your PowerShell terminal and run the following:

   .\pre-checks.ps1 <subscrioptionId> -Register
   # e.g. .\pre-checks.ps1 abc68d12-8e99-4890-b3a0-ca25816b1c26 -Register
   

   You will get an autput similar to the following.

   

Verification script

The verification script checks if you have enough quota and if all required resource providers are registered.

Prerequisites

• PowerShell 7. We recommend installing PowerShell via Winget: winget search Microsoft.PowerShell. For more details, see Installing PowerShell on Windows.

• Azure CLI. We recommend installing Azure CLI via Winget: winget install -e --id Microsoft.AzureCLI. For more details, see Install Azure CLI on Windows.

• Your Azure subscription ID. For more details, see Find your Azure subscription.

• Azure region that you will select during installation.

To run the verification script

1. Download this verification script.
2. Open your PowerShell terminal and run the following:

   .\check.ps1 -SubscriptionId <subscrioptionId> -Location <location>
   # e.g. .\check.ps1 -SubscriptionId abc68d12-8e99-4890-b3a0-ca25816b1c26 -Location uksouth
   

   As a result, you will get a file named results_location.json that will be stored in the same directory. The file will contain the details about the quota and the status of resource providers.

Example output of quota check

"Location": "westeurope",
  "Quotas": [
    {
      "Name": "Standard Dv4 Family vCPUs",
      "Plan": "All",
      "Required": 40,
      "Available": 50,
      "IncreaseRequired": false
    }

Example output of resource providers check

"Providers": [
    {
      "Name": "Microsoft.Authorization",
      "Registered": "Registered"
    },
    {
      "Name": "Microsoft.Cache",
      "Registered": "Registered"
    }

Bring Your Own Private DNS Zones (Optional)

By default, the deployment will create 5 private DNS zone in the managed resource group.

• privatelink.blob.core.windows.net
• privatelink.file.core.windows.net
• privatelink.vaultcore.azure.net
• privatelink.database.windows.net
• privatelink.redis.windows.net

You can enable the use of existing Private DNS Zones during installation.

If you choose to bring your own zones, the deployment will reference them instead of creating new ones.

You would need to make sure that below prerequisite are met.

Prerequisites

1. Virtual Network Link
   Each of the above DNS zones must have a virtual network link established with the Virtual Network (VNet) that will be used during the installation process.

2. Access Control
   The user-assigned managed identity used for deployment must be granted the following roles:

   • Private DNS Zone Contributor on the respective Private DNS Zones.
   • Network Contributor on the target virtual network.

Configure network settings

CluedIn provides flexible network configuration options to support a range of deployment requirements, from standard installations to advanced, zero-trust architectures.

By default, CluedIn provisions a new Azure Virtual Network (VNet) with a predefined address space and an AKS subnet. The default configuration provides network isolation suitable for many deployments. For environments with stricter security requirements or existing network infrastructure, CluedIn also supports advanced network configurations and integration with existing VNets.

Important: If you plan to use an existing VNet or implement an advanced network configuration, consult a CluedIn infrastructure engineer before installation. Some network settings are difficult to change after deployment, so it is important to establish the appropriate network architecture in advance.

Define VNet

During installation, you can review and modify the default network address ranges:

• VNet address space: 10.0.0.0/8

• AKS subnet: 10.0.0.0/16

Ensure that the selected address ranges do not overlap with existing networks that CluedIn needs to communicate with, such as your corporate network, peered VNets, or connected on-premises environments.

If you want to use an existing VNet, consult a CluedIn infrastructure engineer to confirm that the network configuration meets the deployment requirements. You can specify the existing VNet during the Network and monitoring step of the CluedIn installation process.

Analyze CluedIn network configuration

The following diagram illustrates the default CluedIn network configuration after installation.

In the default configuration, the AKS cluster uses an Azure Load Balancer for network traffic. The load balancer provides the configured ingress and outbound connectivity, allowing the application to receive traffic and communicate with external services as required by the deployment.

This configuration is suitable for many standard deployments. However, environments with stricter security requirements may need to restrict application access to private networks and route outbound traffic through controlled network security appliances.

For environments that require tighter network controls, CluedIn supports an advanced network architecture designed to integrate with existing Azure network security infrastructure.

The following diagram illustrates an example of an advanced, zero-trust network configuration.

Depending on your requirements, this architecture can be configured to:

• Restrict application access to private network connectivity.

• Use internal load balancers and private network integration.

• Route outbound traffic through an Azure Firewall or another approved network security appliance.

• Apply firewall policies to control and monitor traffic between the AKS cluster and external services.

Implementing this architecture requires the appropriate network routing, firewall rules, DNS resolution, and connectivity to required external endpoints. Review and configure your firewall policies before deployment, following the Firewall Configuration.

If you need assistance designing or implementing an advanced network configuration, contact a CluedIn infrastructure engineer.

More information regarding networking can be found in Advanced network configuration.

Analyze Azure policies and tagging

The installation wizard supplies consumers to add resource tags during runtime. Please be aware of how tagging works before going through the installation as additional steps may be required.

Tags supplied at runtime will apply to the deployed CluedIn resources. This includes the AKS cluster, key vault, virtual network, log analytics, and a few other resources.

It does not apply to the managed resource group, the AKS node resource group, or the managed application resource itself. This is a limitation of how the Marketplace Applications works.

If your tenant has comprehensive tagging, it is recommended to add a temporary exemption for the subscription at install time, and then add tags post-deployment.

Results

1. You are qualified to perform the CluedIn installation process, and you have all the required permissions.
2. Your Azure subscription can sustain the required quota.
3. You have registered the required resource providers.
4. You have provide the correct access to user assigneed identity used for deployment to all the private dns zone.
5. Your firewall is ready and configured to support the installation of CluedIn.
6. You have planned your network architecture.
7. Your security team is comfortable with CluedIn having co-ownership of the deployed resources.

Next steps

Start the CluedIn installation process as described in our Installation guide.