Azure Local single-node deployment fails with SecretNotFoundException

Hi Maksim Karpenko

Thank you for reaching out regarding the deployment failure on your Azure Local (Azure Stack HCI) single-node environment.

Based on the error you provided:

Exception calling "GetCredential" with "1" argument(s):

'Exception of type 'CloudEngine.Configurations.SecretNotFoundException' was thrown.'

This indicates that the deployment is unable to locate the required Service Principal (SPN) credentials. These credentials are necessary for the Environment Checker and deployment engine to validate and configure your Azure Local environment.

Could you please follow below steps:

1. Create a Service Principal (SPN)

• Sign in to the Azure Portal.
• Navigate to Azure Active Directory → App registrations → New registration.
• Provide the required details and click on register to create SPN.

2. Create a Client Secret

• Go to the newly created SPN and navigate to Certificates & Secrets → New client secret.
• Enter a description and set an expiry period (e.g., 1–2 years).
• Copy the generated Value immediately; this will be used in later steps.

3.Assign a Role to the SPN

• Navigate to your Subscription → Access Control (IAM) → Add role assignment.
• Select the Role: Azure Resource Bridge Deployment Role.
• Assign the SPN as a Member and save the changes.

4.Configure the SPN:

Note: These commands should be executed on the seed node running the deployment. The seed node is identified by the presence of the C:\ECEStore folder, usually the first host in the ARM template or portal node list.

Import-Module C:\CloudDeployment\ECEngine\EnterpriseCloudEngine.psd1
Import-Module ECEClient

#Set the SPN credentials in variables:

$appId = "<application (client) Id>"  
$secret = "<hci secret value (not secret Id)>"
$password = ConvertTo-SecureString  $secret -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential($appId, $password)

#Configure the credentials in ECEStore:
Set-ECESecret -ContainerName "DefaultARBApplication" -Credential $cred | Out-Null
Set-ECEServiceSecret -ContainerName "DefaultARBApplication" -Credential $cred | Out-Null

This completes the setup of the SPN for deployment. The SPN now has the necessary permissions, and the deployment will succeed.

Hope this helps! Please let me know if you have any queries.

Hi Maksim Karpenko,

Just checking if above provided information was helpful! Please let me know if you have any queries.

Thank you for the follow-up. I’m still waiting for a response from our Entra administrators, as I don’t have sufficient permissions to create a SPN myself.

Once I receive feedback from them, I’ll continue with the deployment and update you accordingly.

Hello @Maksim Karpenko I'm currently facing the same issue during Azure local validation. Were you able to identify the root cause or find a solution? If so, could you please share what fixed it for you? Any details about the configuration or missing secret would be greatly appreciated. Thank you!