Picture this: you’re deploying three Azure Local nodes to a remote retail site two states away. Your on-site contact is a store manager named Dave who is great at his job and absolutely terrified of BIOS menus. You’ve got two options — fly someone out there, or figure out a way to make Dave’s job so simple he can’t mess it up. That second option now has a name: Simplified Machine Provisioning.
Starting with a recent release, Azure Local supports simplified machine provisioning to install the OS and register your machines together in a single streamlined process. It’s currently in preview, so manage your expectations accordingly — but having used the traditional ISO-and-pray method more times than I care to admit, I’m genuinely glad this exists.
Here’s the full walkthrough.
—
What’s Actually Going On Under the Hood
Before we dive into steps, it’s worth understanding the mechanism, because it’s not magic — it’s FDO.
Simplified machine provisioning on Azure Local is based on the FIDO Device Onboarding (FDO) specification, an industry-standard approach for securely onboarding devices at scale. The short version: a machine gets a cryptographic identity baked in during a “maintenance environment” boot, and that identity is captured in an ownership voucher — a small .pem file. Once you upload that voucher to Azure, the platform knows exactly which physical box it’s talking to, and it takes over from there.
After the maintenance environment is installed, the device produces an ownership voucher. The ownership voucher is the proof that allows Azure to claim that specific machine.
The new machine provisioning flow uses Azure Arc Site, allowing customers to define configuration once and apply it consistently across multiple machines. In Azure Arc, a site represents a physical business location (store/factory/campus) and the set of resources associated with it. It enables targeted operations and configuration at a per-site level (or across many sites) for consistent management at scale.
One thing worth calling out: when you upload the ownership voucher, Azure creates a provisioned machine resource and creates an entry in the global rendezvous server, which waits for seven days to hear from the physical device. After seven days, if Azure hasn’t heard from the device, the entry is dropped from the rendezvous server. So don’t prep the USB, hand it off to Dave, and then forget about it for two weeks.
—
Prerequisites — Don’t Skip This
The official Microsoft Learn doc covers prerequisites in detail, but here are the ones that’ll bite you if you gloss over them.
Hardware
This preview is limited to specific validated SKUs:
- Lenovo ThinkAgile MX650 V3 and MX650 V4
- HPE ProLiant DL360 Gen11
- Dell AX-750 and AX-650
If your hardware isn’t on that list, you’re on the ISO path for now. Sorry.
You’ll also need:
- A Windows 11 machine with internet access and a USB port
- A USB flash drive with at least 8 GB of space
Azure Prerequisites
Register the feature flag first. This is the step people forget and then wonder why nothing shows up in the portal:
# Register the simplified provisioning feature for your subscription
az feature register \
--subscription <Subscription ID> \
--namespace Microsoft.DeviceOnboarding \
--name AzureLocalZTPThen make sure the following resource providers are registered. Yes, there are a lot of them:
# Register all required resource providers
$providers = @(
"Microsoft.HybridCompute",
"Microsoft.AzureStackHCI",
"Microsoft.DeviceOnboarding",
"Microsoft.Edge",
"Microsoft.GuestConfiguration",
"Microsoft.HybridConnectivity",
"Microsoft.KeyVault",
"Microsoft.ManagedIdentity",
"Microsoft.PolicyInsights",
"Microsoft.Storage",
"Microsoft.Insights"
)
foreach ($provider in $providers) {
Register-AzResourceProvider -ProviderNamespace $provider
}Gotcha #1 — Region lock: In this preview release, only the East US region supports simplified machine provisioning. Your resource group can live elsewhere, but the provisioning resources themselves need to land in East US. If you’ve got Azure Policy enforcing regional restrictions or naming conventions, you’ll hit a wall — more on that in the troubleshooting section below.
Gotcha #2 — RBAC: You need to be either the resource group Owner, or hold both Contributor and Role Based Access Control Administrator on the target resource group. Contributor alone won’t cut it.
—
Step 1: Build the USB
Download the software bundle from Azure Arc > Azure Local > Get started, then click Try provisioning (preview) in the banner. From there, grab the View Downloads option. The bundle includes the maintenance environment ISO, the USB prep tool, and the Configurator app.
Before you run usb_prep.exe, add it to Windows Defender exclusions — otherwise it’ll get flagged mid-run and you’ll have a partially written USB and a bad afternoon:
# Add the USB prep tool to Defender exclusions before running it
Add-MpPreference -ExclusionPath "C:\Path\To\Extracted\usb_prep.exe"Then run the tool from an elevated terminal, point it at the folder containing the ISO, pick your USB drive, and confirm. The tool wipes the drive and writes the bootable maintenance environment. When it’s done, eject cleanly.
—
Step 2: Prepare Each Machine
This is the part Dave can actually do. Plug the USB into the server, power it on, and if it doesn’t boot from USB automatically, get into the BIOS boot menu (usually F2, F12, Delete, or Esc — check your OEM docs).
Before you boot: ensure that Secure Boot and Trusted Platform Module (TPM) are enabled. Both are required. If either is off, the maintenance environment will not be happy with you.
Wait for the maintenance environment setup to complete. The console shows “Maintenance environment setup completed successfully.” Expect two reboots. The whole thing takes up to 30 minutes. Once it’s done, you can pull the USB.
Collecting the Ownership Voucher
You have two options here:
Option A — Configurator App: Open the Configurator App for Azure Local V2 as administrator. Connect to the machine using <serial-number>.local or its IP address. Default credentials are username edgeuser, password Password1. Download the voucher from there.
Option B — Copy from USB: Plug the USB back into your Windows 11 machine and look under \vouchers\<serial-number>\ for a .pem file named after the machine’s serial number. That’s your voucher.
Security note I want to emphasize: store ownership vouchers carefully. Anyone with access to a voucher might be able to attempt to claim the corresponding device to their Azure tenant. Treat vouchers as sensitive deployment artifacts and keep them in a secure, backed-up location until the device is registered. After the device is registered, delete them. These are not files you want sitting in a shared Teams channel.
Repeat Steps 1 and 2 for every machine in the cluster.
—
Step 3: Provision from Azure Portal
Head to Azure Arc > Azure Local > Get started, hit Try provisioning (preview) in the banner, then select Provision.
Create your Arc Site first. The site is the logical container for your physical location. Once the site exists, configure the site-level settings that apply to all machines under it:
| Parameter | Notes | |—|—| | Time zone | Applies to new machines only — existing ones won’t be updated | | Time server | Same behavior — new machines only | | Key Vault | For storing local admin credentials | | Proxy server | If your edge site needs one |
Once the site is configured, upload your ownership vouchers, select the OS profile for each machine, set the machine name (this becomes the Azure Arc resource name), and hit Review + Create.
Gotcha #3 — Azure Policy conflicts: if your administrator has set up an Azure Policy that includes requirements like resource groups being created in a specific region, using a specific naming convention, or requiring ARM tags — you’ll hit failures. In this preview release, only East US supports simplified machine provisioning, and simplified machine provisioning doesn’t currently support ARM tag requirements. Check your policy assignments before you start, not after you get the InternalServerError.
—
Step 4: Let Azure Do the Work
Once provisioned, the machine phones home automatically. The maintenance environment is a lightweight bootstrap OS that connects the machine to Azure, installs required Azure Arc extensions, and then downloads and installs the Azure Local operating system.
Your on-site person (hi Dave) just needs to keep the machine plugged into the network and powered on. That’s it.
You can watch progress in two places:
Portal: Navigate to Azure Arc > Operations > Provisioning (preview) > Provisioned machines tab.
Configurator App: Connect to the machine using <serial-number>.local or IP, use the edgeuser / Password1 credentials during the maintenance environment phase. After the Azure Stack HCI OS installs, switch to the admin credentials you configured during provisioning.
Status and progress are visible in both the Azure portal and the Configurator app. IT teams can monitor, troubleshoot, and complete provisioning remotely.
—
Step 5: Verify Arc Connectivity and Move to Clustering
In the portal, check Azure Arc > Operations > Provisioning (preview) > Provisioned machines. Wait for each machine to show Ready to cluster status. Once you’re there, you’re done with this phase.
The good news: because simplified provisioning handles OS installation and Arc registration together, you can skip the manual registration step when you go to deploy the cluster. Head straight to subscription permissions setup, then pick your deployment method:
- Deploy via Azure portal
- Deploy via ARM template (great for repeating this across many sites)
ZTP shifts most of that work to Azure so that on-site staff can perform a few physical tasks while central IT teams manage configuration remotely. That’s the actual value proposition here — not just speed, but the ability to deploy consistently to locations where you don’t have skilled infrastructure staff on the ground.
—
Limitations Worth Knowing Right Now
- Azure Arc gateway is not supported with simplified machine provisioning in this preview. If your environment routes Arc traffic through an Arc gateway, you’ll need to plan around that.
- Simplified machine provisioning currently doesn’t support automatic retries from the service in case the OS installation fails. If the OS install tanks, you’re manually cleaning up and re-uploading the voucher.
- Hardware SKU list is short. If you’re not on Lenovo MX650, HPE DL360 Gen11, or Dell AX-750/650, check back later.
- East US only for provisioning resources. Full stop.
—
What to Watch Next
This feature is clearly the foundation for something bigger. The consistent onboarding model across device classes means this foundation can extend beyond servers to broader edge scenarios. I’d watch for the hardware SKU list to expand significantly, Arc gateway support to land, and eventually for this to become the default path rather than the ISO method.
If you’re running multi-site Azure Local deployments — retail, manufacturing, branch offices — this is worth piloting now even in preview. The ARM template path for provisioning servers at scale is exactly the kind of repeatable, infrastructure-as-code approach that makes large rollouts manageable. Get familiar with the flow before it hits GA and everyone’s trying to figure it out at once.
