Why · what AIO deployment looks like today, and the gaps Scale Kit and Launchpad fill

Step 1 — Prepare the cluster

Before any AIO command runs, the cluster and subscription have to be in a very specific shape. The list isn't long — it's just precise, undocumented in one place, and easy to get wrong.

Per-cluster prerequisites · in the order you actually do them

16 items

1.Subscription RPs

Microsoft.ExtendedLocation RP registered (custom locations)
Silent 'resource not found' downstream if missing
Microsoft.IoTOperations RP registered
Per-subscription one-time, easy to miss in new subs
Microsoft.DeviceRegistry RP registered
Same
Microsoft.SecretSyncController RP registered
Same

2.Operator tooling

Azure CLI + azure-iot-ops extension installed
Version drift across operators causes silent flag differences
Azure CLI connectedk8s extension installed
Required before any Arc connect command runs
kubectl + helm installed, kubeconfig pointed at the cluster
Per-laptop setup; no central enforcement

3.Cluster

Kubernetes cluster (AKS EE / K3s / RKE2)
Distro choice not obvious; some break on AIO updates
Connected to Azure Arc with custom locations enabled
Two-step enable; easy to forget --enable-custom-locations
OIDC issuer enabled on the cluster
Required before identity federation works
Workload identity federation enabled
Same az connectedk8s update — but separate flag

4.Identity & secrets

User-assigned managed identity for AIO components
Two MIs needed, often confused
User-assigned managed identity for AIO secrets
Distinct from the components MI
Azure Key Vault in the same tenant (RBAC mode)
Access-policy mode silently breaks secret sync

5.Schema Registry

Storage account with hierarchical namespace
Schema Registry create fails without HNS enabled
Schema Registry resource
Resource ID feeds into az iot ops create later

Step 1 of 3