Azure verification for VMs on Azure Local

1. In your Azure Local resource page, navigate to the Configuration tab.

2. Under the feature Azure verification for VMs, view the host attestation status.

   

Azure CLI is available to install in Windows, macOS, and Linux environments. It can also be run in Azure Cloud Shell. This section describes how to use Bash in Azure Cloud Shell. For more information, see Quickstart for Azure Cloud Shell.

Launch Azure Cloud Shell and use Azure CLI to check Azure VM verification following these steps:

1. Set up parameters from your subscription, resource group, and cluster name.

   subscription="00000000-0000-0000-0000-000000000000" # Replace with your subscription ID
   resourceGroup="local-rg" # Replace with your resource group name
   clusterName="LocalCluster" # Replace with your cluster name
   
   az account set --subscription "${subscription}"
   

2. To view Azure VM verification status on a cluster, run the following command:

   az stack-hci cluster list \
   --resource-group "${resourceGroup}" \
   --query "[?name=='${clusterName}'].{Name:name, AzureBenefitsHostAttestation:reportedProperties.imdsAttestation}" \
   -o table
   

Check machine status of Azure VM verification

1. In Windows Admin Center, select Cluster Manager from the top drop-down menu, navigate to the system that you want to activate, then under Settings, select Azure verification for VMs.

2. To check Azure VM verification machine status:

   • Cluster-level status: Host status appears as On.

   • Server-level status: Under the Server tab in the dashboard, check that the status for every machine shows as Active in the table.

     

Troubleshoot machines

• Under the Server tab, if one or more machines appear as Expired:
  • If the machine hasn't synced with Azure for more than 30 days, its status appears as Expired or Inactive. Select on Sync with Azure to schedule a manual sync.

Manage benefits activated on VMs

1. To check what benefits are activated on VMs, navigate to the VMs tab.

2. The dashboard shows the number of VMs with:

   • Active benefits: These VMs have Azure-exclusive features activated via Azure VM verification.
   • Inactive benefits: These VMs have Azure-exclusive features that need further action before activation.
   • Unknown: We can't determine the eligible benefits for these VMs because Hyper-V data exchange is turned off. See the following troubleshooting section.
   • No applicable benefits: These VMs don't have Azure-exclusive features and hence don't require Azure VM verification.

3. The table displays the Eligible benefit that is applicable for each VM. See the full list of benefits available on Azure Local.

   

Troubleshoot VMs

• Under the VMs tab, if one or more VMs appear as Inactive benefits:

  • If the action suggested is to Install updates, you might not have the minimum OS version required for the benefit. Update the VM to meet the version requirements for workloads.
  • If the action suggested is to Turn on Guest Service Interface, select it and open the context pane to enable the Hyper-V Guest Service Interface. This feature is required for VMs to communicate to the host via VMbus.
  • If the action suggested is regarding legacy OS support, see troubleshooting for legacy OS support.

• Under the VMs tab, if one or more VMs appear as Unknown:

  • If you want to determine the benefits available for these VMs, you can either do so manually by checking the full list of benefits available on Azure Local, or Windows Admin Center can display this information. To access the information through Windows Admin Center, enable Hyper-V data exchange (KVP) for your VMs by selecting the action labeled Turn on Hyper-V data exchange.

Check machine status of Azure VM verification

• When Azure VM verification setup is successful, you can view the host status. Check the system property IMDS Attestation by running the following command:

  Get-AzureStackHCI
  

• Or, to view Azure VM verification status for machines, run the following command:

  Get-AzureStackHCIAttestation [[-ComputerName] <string>]
  

Troubleshoot machines

• If Azure VM verification for one or more machines isn't yet synced and renewed with Azure, it might appear as Expired or Inactive. Schedule a manual sync:

  Sync-AzureStackHCI
  

Manage benefits activated on VMs

• To check access to Azure VM verification for VMs, run the following command:

  Get-AzStackHCIVMAttestation
  

  Note

  A VM that is supported for v2 can communicate with the machine using VMBus. Conversely, a v1 supported VM is configured with legacy OS support and can access Azure VM verification via REST. If a VM supports both v1 and v2, the v2 method (i.e. VMBus) is primarily used, but it can fall back to v1 if v2 encounters an issue.

Troubleshoot VMs

• To set up access to Azure VM verification for VMs, you can enable the Hyper-V Guest Service Interface.

  To check that Hyper-V Guest Service Interface is enabled, run:

  Get-VMIntegrationService [[-VMName] <VMName>] -Name "Guest Service Interface"
  

• To turn on the Hyper-V Guest Service Interface:

  Enable-VMIntegrationService [[-VMName] <VMName>] -Name "Guest Service Interface"
  

• To check that the VMs can access Azure VM verification on the host, run the following command on the host:

  Invoke-RestMethod -Headers @{"Metadata"="true"} -Method GET -Uri "http://127.0.0.1:42542/metadata/attested/document?api-version=2018-10-01" –usedefaultcredentials
  

You can't view legacy OS support from the Azure portal at this time.

Azure CLI is available to install in Windows, macOS, and Linux environments. It can also be run in Azure Cloud Shell. This section describes how to use Bash in Azure Cloud Shell. For more information, see the Quickstart for Azure Cloud Shell.

Launch Azure Cloud Shell and use Azure CLI to check Azure VM verification by following these steps:

1. Set up parameters from your subscription, resource group, and cluster name:

   subscription="00000000-0000-0000-0000-000000000000" # Replace with your subscription ID
   resourceGroup="local-rg" # Replace with your resource group name
   clusterName="LocalCluster" # Replace with your cluster name
   
   az account set --subscription "${subscription}"
   

2. To view legacy OS support status on a cluster, run the following command:

   az stack-hci cluster list \
   --resource-group "${resourceGroup}" \
   --query "[?name=='${clusterName}'].{Name:name, AzureBenefitsHostAttestation:reportedProperties.supportedCapabilities}" \
   -o table
   

1. Turn on legacy OS support on the host

1. In Windows Admin Center, select Cluster Manager from the top drop-down menu, navigate to the system that you want to activate, then under Settings, select Azure verifications for VMs.

2. In the section for Legacy OS support, select Change status. Select On in the context pane. This setting also enables networking access for all existing VMs. You must manually turn on legacy OS support for any new VMs that you create later.

3. Select Change status to confirm. It might take a few minutes for machines to reflect the changes.

4. When legacy OS support is successfully turned on:

   • Check that Legacy OS support appears as On.

   • Under the Server tab in the dashboard, check that legacy OS support for every machine shows as On in the table.

     

2. Enable access for new VMs

You must enable legacy OS networking for any new VMs that you create after the first setup. To manage access for VMs, navigate to the VMs tab. Any VM that requires legacy OS support access appear as Inactive. Select the action to Set up legacy OS networking for the selected VM, or for all existing VMs on the system.

1. Turn on legacy OS support on the host

• Run the following command from an elevated PowerShell window on your Azure Local:

  Enable-AzStackHCIAttestation
  

• Or, if you want to add all existing VMs on setup, you can run the following command:

  Enable-AzStackHCIAttestation -AddVM
  

• Check that legacy OS support is turned on:

  Get-AzureStackHCIAttestation [[-ComputerName] <string>]
  

Troubleshoot machines

• To turn off and reset legacy OS support on your system, run the following command:

  Disable-AzStackHCIAttestation -RemoveVM
  

2. Enable access for VMs

• To configure networking access for selected VMs, run the following command on your Azure Local:

  Add-AzStackHCIVMAttestation [-VMName]
  

• Or, to add all existing VMs, run the following command:

  Add-AzStackHCIVMAttestation -AddAll
  

• Get list of VMs that have access to legacy OS support:

  Get-AzStackHCIVMAttestation
  

  Note

  To successfully enable legacy OS support on Generation 1 VMs, the VM must first be powered off to enable the NIC to be added.

Troubleshoot VMs

• To remove access to legacy OS support for selected VMs:

  Remove-AzStackHCIVMAttestation -VMName <string>
  

  Or, to remove access for all existing VMs:

  Remove-AzStackHCIVMAttestation -RemoveAll
  

• To check that the VMs can access legacy OS support on the host, run the following command on the VM:

  Invoke-RestMethod -Headers @{"Metadata"="true"} -Method GET -Uri http://169.254.169.253:80/metadata/attested/document?api-version=2018-10-01