Deploy an ArcGIS Server site on Microsoft Azure

You can deploy a stand-alone ArcGIS Server site on Microsoft Azure and publish to it from ArcGIS Pro clients deployed in Microsoft Azure.

You can deploy one of the following stand-alone ArcGIS Server sites for the following roles:

• GIS Server—Publish map, feature, geocoding, geometry, geoprocessing, network, and print services.
• ArcGIS GeoEvent Server—Stream real-time data through GeoEvent services.
• ArcGIS Image Server—Publish image services.

You need the following to deploy a stand-alone ArcGIS Server site on Microsoft Azure:

• Microsoft Azure subscription
• Esri images
• ArcGIS Enterprise Cloud Builder for Microsoft Azure
• ArcGIS Enterprise Cloud Builder for Microsoft Azure
• The type of ArcGIS Server license needed for the server role—ArcGIS GIS Server, ArcGIS GeoEvent Server, or ArcGIS Image Server
• An SSL certificate from a certifying authority that you have exported to a .pfx file and for which you have set up CNAME mapping to the domain you specify in Cloud Builder (optional, but recommended)

Get a Microsoft Azure subscription

A Microsoft Azure subscription and account are required to use Microsoft Azure infrastructure and services. Contact Microsoft to purchase a subscription.

Enable programmatic deployment of ArcGIS images

Before you can use the images from the Azure Marketplace, you must enable the programmatic deployment of ArcGIS. An administrator of your Azure subscription must enable programmatic deployment once for each type of ArcGIS image. This enables all current and future ArcGIS images of that type on the Azure Marketplace.

1. Sign in to the Azure portal.
2. Browse to the ArcGIS image in the Virtual Machine Marketplace.
   1. Click Marketplace on the home screen.
   2. Choose Virtual Machines.
   3. Type arcgis in the search text box.
3. Choose the ArcGIS image you need from the search results.
4. Click Want to deploy programatically? Get Started at the bottom of the pane.

   The Configure Programmatic Deployment pane appears.

5. Read the legal terms and Azure Marketplace Terms. If you accept the conditions, proceed with enabling programmatic deployment.
6. Click Enable for your subscription.
7. Click Save.

Your Azure subscription is now set to use an Esri image from Cloud Builder.

Configure a Windows Domain controller in your Azure environment (optional)

To use a Windows Domain controller with your deployment, you must configure it before you create the deployment.

To use a domain account to run the Windows services used by ArcGIS software, create that domain account before you create your deployment.

Obtain a license from Esri

To deploy an ArcGIS Server site, you need an ArcGIS Server license for the server role you are configuring.

Once these licenses are available to your account, you can download them from My Esri.

Install ArcGIS Enterprise Cloud Builder for Microsoft Azure

Download and install ArcGIS Enterprise Cloud Builder for Microsoft Azure 11.3.

Deploy a stand-alone site

Use ArcGIS Enterprise Cloud Builder for Microsoft Azure to deploy a stand-alone ArcGIS GeoEvent Server, GIS, or ArcGIS Image Server site on Microsoft Azure.

Steps are organized into subsections to help you navigate through Cloud Builder.

Connect and begin configuration of the ArcGIS Server site

Start Cloud Builder, sign in to your Microsoft Azure account, and choose to create a stand-alone ArcGIS Server site.

1. Start ArcGIS Enterprise Cloud Builder for Microsoft Azure.
2. Sign in to Microsoft Azure.

   If you want to use the Microsoft Azure Government cloud and have an Azure Government subscription, check U.S. Government Cloud.

   Note:

   The account you use to connect must be assigned the following roles at minimum:

   • The Azure Reader role at the subscription scope level
   • The Azure Contributor role at the resource group scope level if you will use resource groups that you create outside Cloud Builder

3. Choose an Entra ID tenant, click Next, choose a subscription in which to create a deployment, and click Next.
4. Ensure the V2 Sites option is selected and click Deploy a new site.
5. Choose Stand-Alone Server and choose the ArcGIS Server site role you require:
   • GIS Server
   • GeoEvent Server
   • Image Server
6. Click Next to proceed to the Site Options settings.

Specify site options

Specify a resource group, choose how many machines to include in the site, and choose the virtual machine image that will be used to create the machines.

1. Choose a resource group or click the Add button to create a resource group for your site.

   A resource group is a container that holds related resources for an application.

   1. Provide an intuitive name for the resource group.

      The name can contain alphanumeric characters, dashes (-), underscores (_), parentheses (()), and dots (.).

   2. Click Check Availability to ensure the name is unique and can be used for your resource group.
   3. Choose a region for the resource group.
   4. Click Create.
   5. Once the resource group is created, click Close.
2. Choose a deployment type.

   The deployment type option is not available for ArcGIS GeoEvent Server sites because they always contain only one machine.

   • If you have an ArcGIS Server workgroup edition license, are deploying a test or demonstration site, or only want one machine in your ArcGIS Server site, choose the Single machine deployment type option. Only one Azure machine will be used for your site.
   • If you have an enterprise edition ArcGIS Server license and want to distribute processing and connection loads across multiple machines, choose the Multi machine deployment type option.
3. To avoid duplication of Azure resource names in resource groups, Cloud Builder allows you to prefix resources with a specified string. Check Prefix Azure Resource Manager (ARM) Resource names with and provide up to three alphanumeric characters.

   Cloud Builder automatically populates this value with a random two-character string. To change the string, type a different prefix to add to Azure resource names such as load balancers and availability sets.

   Prefixes must start with an alphabetic character.

   Adding a prefix avoids duplication of resource names and allows you to categorize resources according to your requirements for managing in the Azure portal or billing.

   For disaster recovery configurations, create multiple resource groups with the same prefix.

4. Choose the machine image to use: an image provided by Esri, a managed image, an image in the Azure Compute Gallery, or an image you create.

   The image must exist in the region in which you will create the deployment.

   • To use an Esri image, choose the image from the drop-down list.
   • To use an image that is already in the image list, choose Managed Images and then choose the image from the drop-down list.
   • To use a machine image in the Azure Compute Gallery, choose the gallery from the Select Gallery drop-down list, choose the machine image from the Select Image drop-down list, and choose the ArcGIS software version to include on the image from the Select Version drop-down list.
   • To create an image from a source VHD file, choose Managed Images, and follow these steps:
   1. Click the Add button next to Select Image.
   2. Type a name for the image and click Check Availability to ensure the name is unique.

      The image name can contain only letters, numbers, underscores (_), dots (.), and hyphens (-). The name must start with a letter or number and end with a letter, number, or underscore.

   3. Choose or create a resource group in which to store the image.
   4. Choose the region in which to create the image.

      Use the same region that contains the .vhd file from which you create the image.

   5. For Source Disk, click the button to browse to the .vhd file in your storage account. Choose the storage account that contains the file, choose the file, and click OK.

      The storage accounts available on the Select Image Disk dialog box are based on the region you chose in the previous step.

   6. Choose the type of image to create.

      HDD uses magnetic storage. SSD images use faster, solid-state drives.

   7. For Size, choose the image size.

      The image size determines the minimum size of the operating system disk (C:\) of the virtual machine created from the image. You can increase the size of the provisioned disk for the virtual machine created from the image, but you cannot decrease the size below the image size.

      See the Microsoft Azure documentation for more information about Azure managed disks.

   8. Click Create to create the image.

   Once created, the image is now available in the list of images for you to choose the next time you create a deployment.

5. Optionally, add one or more user-assigned managed identities for authentication purposes when accessing an Azure Blob storage container used for the configuration store or cloud storage data stores.
   1. Click the Add button in the Assign User Managed Identity section.
   2. Choose the subscription that contains the identity.
   3. Choose the user-assigned managed identity from the Identity drop-down list and click Add.

   Tip:

   The Azure Storage Blob Data Owner role and Storage Table Data Contributor role must be assigned to the user-assigned managed identity to access the configuration store. See the Microsoft Azure documentation for instructions to assign a role to a user-assigned managed identity.

6. Click Next to proceed to the Networking Options settings.

Set networking options

Choose or create a virtual network, its subnets, and IP address.

1. Choose an existing virtual network from the drop-down list or click the Create button to create a virtual network.
2. To create a virtual network using Cloud Builder, specify the following:
   1. Type a name for the virtual network.

      Names must be unique within your Azure subscription.

   2. Click Check Availability to ensure the name you typed is unique.

      If the name is unique, a check mark appears in the Name field.

   3. Choose the range of TCP/IP addresses (the address space class) to be used by your virtual network.

      See the Microsoft documentation for more information about address classes.

   4. Choose the CIDR value from the VM Count drop-down list to determine the maximum number of addresses to be used in your address space.
   5. Click Create.
   6. Once the virtual network is created, click Close.
3. Choose or create a subnet for your virtual network.

   If you create a subnet, you must provide a unique name and an address range. See the Microsoft Azure documentation for information about virtual network subnet addresses.

4. Choose or create a second subnet for the Application Gateway Subnet setting.

   All V2 deployments are accessed through an Azure Application Gateway. Azure Application Gateways require a dedicated subnet.

5. The application gateway requires an IP address provided by Microsoft Azure, and the IP address must have a DNS name associated with it. Use one of the following:
   • Existing Public IP—Choose an IP address from the drop-down list.

     If you use an existing public IP address, the IP address must use a standard SKU. See the Microsoft Azure documentation for more information about public IP addresses and SKU.

   • New Public IP—Type a name for a public domain that ArcGIS Enterprise Cloud Builder for Microsoft Azure will create.
   • New Private IP—Type a name for a private IP address that Cloud Builder will create.

     Note:

     Before you can use this option, you must configure your Azure subscription to use preview features. See the Azure help for information.

     Also, you must configure DNS entries for the private IP that will be allocated dynamically from the Application Gateway subnet before you use this option.

   The domain name is in the format mydomain.<location>.cloudapp.azure.com.

   Domain names must be unique within an Azure region. A green check mark appears if your domain name is unique.

   Note:

   To use a certificate authority-issued SSL certificate, the domain name must match the CNAME mapping you configured for the certificate.

6. Click Next to proceed to the Certificate Options settings.

Use SSL certificates

For sites used in production environments, use an SSL certificate issued by a certificate authority (CA).

1. Specify the SSL certificate to use for the ArcGIS Server site.

   Esri recommends that you use a certificate issued by a CA.

   • To use a CA certificate, choose Certificate issued by a Certificate Authority and proceed to the next step.
   • If you are setting up an ArcGIS Server site for testing purposes and choose not to use a CA certificate, choose Self Signed Certificate (Automatically generated) and click Next to proceed to the Machine Options settings.

     Cloud Builder will generate a self-signed certificate for your virtual machines. People connecting to your ArcGIS Server site and services will receive warnings that the site is not trusted if you use a self-signed certificate.

2. Choose one of the following to specify the .pfx file that you exported from your certificate:
   • From File—Type or browse to the .pfx file in the Pfx File field, and, in the Password field, type the password configured for the file.
   • From Key Vault—Specify the Azure key vault where the CA certificate is stored, and choose the certificate file using the Certificate drop-down list.

     Note:

     You can only choose a CA certificate that you uploaded to the key vault using Cloud Builder when you created another deployment. If this is the first time using this certificate, choose the key vault from the drop-down list, click the Create button next to the Certificate drop-down list, and upload the certificate.

3. Click Next to proceed to the Machine Options settings.

Specify machine options

Specify credentials for the virtual machine administrator and enable optional machine settings such as remote desktop access, automatic shutdown, and automatic operating system updates. You can also add the machines to an existing domain in Azure.

Additional options on this Cloud Builder page vary depending on whether you create a single-machine or multiple-machine site and what type of site you create.

1. Type a username and password for Machine Administrator.

   This is the Windows login you will use to administer the virtual machines in the site, and you will need it when you upgrade the deployment. The same login and password are used for all machines in the site.

   The username must contain three or more characters and contain no spaces, and it cannot be admin or administrator. The password must meet Windows Server complexity requirements.

2. If you're creating a single-machine site, click the Configure Virtual Machine button to define specifications for the machine (or machines) in the ArcGIS Server site.

   ArcGIS Server is licensed by core. See the Azure compute unit information in the Microsoft Azure help to determine how many virtual cores are present on each type of Azure virtual machine.

Tip:

You can change disk types and sizes after you deploy.

3. Choose the time zone you want your virtual machines to use.
4. If you have an existing Windows Domain in your Azure environment to which you want to add your machine (or machines), click Domain Join Options.
   1. On the Domain Join Options dialog box, check the Join Existing Windows Domain check box.
   2. Provide the name of the Entra ID domain.
   3. Provide the username and password for the domain administrator.
   4. Click Apply.
5. If you're creating a single-machine site, type a Name for the virtual machine.

   Note:

   If you later configure a second site for disaster recovery, give the primary and secondary sites an identical name but place them in separate virtual networks and in separate resource groups that have been assigned the same prefix.

6. If you check the box next to Enable automatic operating system updates, Microsoft Azure will apply updates to the operating systems on your virtual machines.
7. If you do not require access to your deployment during specific hours of the day, you can configure the machines to shut down at a specific time each day. To do this, check the box next to Enable daily automatic shutdown and set the shutdown time from the drop-down list.

   The time is in the time zone you chose for the virtual machines.

   Shutting down machines allows you to save money because the machines are not running when you do not need them. However, the machines do not automatically restart; you must restart each machine in the deployment when you need them again. You can restart the machines from Cloud Builder or the Microsoft Azure portal.

8. If you need to directly sign in to your virtual machines, check Enable remote desktop access using a jumpbox port.

   The port shown is the port through which you will access the machines.

   In a multiple-machine deployment, the remote desktop connection provides access to the file share machine. To access the other machines in the deployment, connect to the file share machine and, from there, use remote desktop connections to the other machines using the machine host names, fully qualified domain names, or IP addresses.

9. If you're creating a multiple-machine site, accept the default machine name prefix or type a prefix to add to the virtual machine names.

   Cloud Builder automatically populates this value with a random two-character string. To change the string, type a different prefix to add to Azure resource names such as load balancers and availability sets.

   Prefixes must start with an alphabetic character.

   Adding a prefix avoids duplication of resource names and allows you to categorize resources according to your requirements for managing in the Azure portal or billing.

10. If you're creating a multiple-machine site, you can accept default machine types, sizes, and names or define your own.
    • Use default names and sizes for the machines—All virtual machines in the site will be the same type with the same disk sizes, based on the virtual machine image you chose on the Cloud Builder Site Options page. The ArcGIS Server site will contain two machines.
    • Specify names and sizes for the individual machines—When you choose this option, Cloud Builder presents you with the Machine Names page, where you will choose the number, types, and sizes of machines in the deployment and the machine names.

    ArcGIS Server is licensed by core. See the Azure compute unit information in the Microsoft Azure help to determine how many virtual cores are present on each type of Azure virtual machine.

11. Click Next.
    • If you're creating a GIS Server site, clicking Next takes you to the Database Options settings.
    • If you're creating a GeoEvent Server or ArcGIS Image Server site, clicking Next takes you to the License and Credentials settings.

Choose database options

You can register a database with a GIS Server site or ArcGIS Image Server site when you create the site. Use the database to store source data for ArcGIS Server web services.

When you register a database when you create the site, the database always contains an enterprise geodatabase.

You can upload data to this enterprise geodatabase on Azure to use with ArcGIS Pro and ArcGIS Server sites on Azure.

Tip:

You can use Cloud Builder to add a database to an ArcGIS Server site after you deploy the site. When you register the database after creating the site, you have additional options for registration. When registering a database with an ArcGIS Image Server site, the database must contain a geodatabase and it cannot be registered as a managed database.

1. Choose the type of database to register with the site.
   • If you do not want to register a database with the site at this time, choose None from the Database Type drop-down menu and proceed to the next step.
   • If you choose a database service (Microsoft Azure SQL Database, Microsoft Azure SQL Managed Instance, or Microsoft Azure Database for PostgreSQL), create or choose an existing database server and database, and provide a username and password for the database administrator and for a user who has permissions to create data in the database.

     If these resources don't exist, Cloud Builder will create them.

     Note:

     Cloud Builder will only create Microsoft Azure Database for PostgreSQL (Flexible Server) instances. However, if you have an existing single-server instance, you can choose it.

   • If you choose Microsoft SQL Server, follow these steps to create and register a database:
   1. Type a name for the virtual machine that will host the Microsoft SQL Server database.
   2. Click Machine Options and choose a SQL Server version from the Image drop-down menu.
   3. Use the default machine type and size, or click the Configure Virtual Machine button to specify the disk types, machine type, and disk sizes for the virtual machine.
   4. Click Apply to save the machine settings.
   5. Type a name for the database.

      The name must meet SQL Server requirements.

   6. Type a username and password for the database administrator.

      This username and password will also be used for the machine administrator.

   7. Type a username and password for a database user who will have permissions to create tables in the database.
2. Click Next.
   • If you're creating a multiple-machine site and you chose the Specify names and sizes for the individual machines option on the Machine Options settings page, clicking Next takes you to the Machine Names settings.
   • If you're creating a single-machine site or if you're creating a multiple-machine site but you chose to accept default machine names and sizes, clicking Next takes you to the Data Store Item settings.

Add a cloud storage data store

If you're creating a GIS Server site or ArcGIS Image Server site, you can register a cloud storage location with the site. This is similar to registering a cloud store in ArcGIS Server Manager.

1. Click the Add button .
2. Click the Browse button (...) to choose a folder in an existing Blob storage container or create a container.

   The Select Blob Container appears.

3. Choose an existing storage account from the Storage Account drop-down list or click the Create button to create an account.
4. From the Authentication Type drop-down list, choose the method to use to authenticate connections to the container.
   • AccessKey—When you choose this option, Cloud Builder will obtain the access key for the account.
   • UserAssignedIdentity—This option is available if you added a user-assigned managed identity to the machines in the deployment when you configured site options. If you choose this option, choose one of the identities from the Identity drop-down list.
   • SASToken—Provide the token in the SAS Token field. See the Microsoft Azure help for information about SAS tokens for Blob storage containers.
   • ServicePrincipal—If you configured a service principal for the account used for the deployment, provide the tenant ID, client ID, and client secret for the service principal. See Microsoft Azure help for an explanation of service principals.

     To use the storage location as a raster store or to store service caches, the Azure Storage Blob Data Contributor role must be assigned to the service principal. To use the storage location as a user-managed cloud storage data store, the Azure Storage Blob Data Reader role must be assigned to the service principal.

5. Choose an existing folder or subfolder in the storage account or click the Create a container button to define a new container name.
6. Click OK to close the Select Blob Container window.
7. Optionally, for ArcGIS Image Server sites, check the box next to one of the following options to register the cloud storage location for additional uses:
   • Register as Raster Store—Registers the cloud storage location to store output from raster analysis tools.
   • Register as Cache Directory—Registers the cloud storage location to be used by the ArcGIS Image Server site to build and store caches for the cached image services that are published to the site.
8. Optionally, for GIS Server sites, check the box next to Register as Cache Directory to use the cloud storage location to build and store caches for cached map services (map image layers) that are published to the GIS Server site.
9. Click Add to register the cloud storage location with the site as a data store.
10. Click Next.
    • If you're creating a multiple-machine site and you chose the Specify names and sizes for the individual machines option on the Machine Options settings page, clicking Next takes you to the Machine Names settings.
    • If you're creating a single-machine site or if you're creating a multiple-machine site but you chose to accept default machine names and sizes, clicking Next takes you to the License and Credentials settings.

Customize machine names, numbers, and other settings

If you're creating a multiple-machine site and need to customize the machine settings, you can specify the number of machines in the ArcGIS Server site, the names of the machines in the site, the name of the file server machine, and the specifications for each of the machines.

1. Click the plus (+) or minus (-) buttons to change the number of machines in the ArcGIS Server site.
2. You can type a different name for any of the machines in the deployment.

   Note:

   All machines in the same deployment should include the same two- to three-character prefix.

3. To change the type and size of any of the virtual machines, and to add disks to any of the machines, click the Configure Virtual Machine button .
4. Click Next to proceed to the License and Credentials settings.

Specify the license and credentials

Specify the ArcGIS Server license file, a URL context for the site, as well as authentication information for the site and Windows service administrators.

1. Browse to the location of your ArcGIS GIS Server, ArcGIS GeoEvent Server, or ArcGIS Image Server license file.
2. Provide a context name for the ArcGIS Server site's URL. The context is the identifier in the URL that routes you to the correct site.

   For example, in the following URL, mygisserver is the context: https://mydeployment.domain.com/mygisserver.

3. Type a username and password for Site Administrator.

   This is the ArcGIS Server primary site administrator account. Keep track of this information, because you will need it when you manage the deployment.

4. Type a username and password for ArcGIS Service Account, which is the Windows login under which the ArcGIS Server service will run.

   Keep track of this information, because you will need it when you manage the deployment.

5. Click Next to proceed to the Deployment Options settings.

Specify deployment options

Deployment options include specifying storage locations for deployment artifacts and choosing logging settings.

1. Choose or create a storage account for your deployment. To create a storage account, follow these steps:
   1. Type a name for the storage account.

      Names must be unique. Click Check Availability to confirm the storage account name is unique.

   2. Choose the Azure region where your storage will reside.
   3. Choose an existing resource group for the storage account or create one.
   4. Choose the type of redundancy for your storage account: Geo-Redundant, Locally Redundant, or Read-Access Geo-Redundant.

      See Azure Storage redundancy in the Microsoft Azure documentation for a description of each option.

   5. Specify the kind of Azure storage account to use: Storage (a legacy account type), StorageV2 (a basic account type), or BlobStorage (only supports Azure Blob storage).
   6. Once the storage account is created, click Close.
2. Check Use Azure Cloud Storage for the configuration store if you want to store the ArcGIS Server directories in Azure Cloud Storage.

   Placing directories in Azure Cloud Storage makes them highly available. If you do not check this option, the directories are stored on disk on the virtual machine used as the file share for the site.

3. If you check Use Azure Cloud Storage for the configuration and content store, choose which storage option to use.
   • Choose Azure Files (SMB) to store your ArcGIS Server configuration store and directories in Azure Files.

     Note:

     Azure Files (SMB) is not recommended for production sites.

   • Choose Azure Blobs and Tables to store the ArcGIS Server configuration store in Azure Blob Storage.
4. Specify or create the Azure storage account for the Azure Cloud Storage.

   The storage account must be in the same region as your ArcGIS Server site. To create a storage account in the region group for this site, follow these steps:

   1. Click the Add button .
   2. Type a name for the storage account.

      Names must be unique. Click Check Availability to confirm the storage account name is unique.

   3. Choose the type of redundancy for your storage account: Geo-Redundant, Locally Redundant, or Read-Access Geo-Redundant.

      See Azure Storage redundancy in the Microsoft Azure documentation for a description of each redundancy option.

   4. Click Create. When the storage account is created, click Close to return to Deployment Options.
5. If you use the Azure Blobs and Tables option, choose one of the following from the Authentication Type drop-down list, and provide credentials necessary for each authentication type.
   • AccessKey—When you choose this option, Cloud Builder will obtain the access key for the account.
   • UserAssignedIdentity—This option is available if you added a user-assigned managed identity to the machines in the deployment when you configured site options. If you choose this option, choose one of the identities from the Identity drop-down list.
   • ServicePrincipal—If you configured a service principal for the account specified in the previous step, provide the tenant ID, client ID, and client secret for the service principal. See Microsoft Azure help for an explanation of service principals.

     The Azure Storage Blob Data Owner role and Storage Table Data Contributor role must be assigned to the service principal.

6. Click Next to view a summary of your settings.

Review the summary and deploy the site

Ensure the stand-alone ArcGIS Server deployment contains what you need and create the deployment.

You can also estimate costs for the infrastructure you chose and export the deployment options so you can automate the creation of future stand-alone sites.

1. Review the settings in the Summary pane. If anything needs to be changed, click Back to go to the page where you need to change the information.

   Tip:

   Click Save Summary to save your site configuration information to a text file so you can refer to it for information such as usernames or machine names.

2. Click Generate Cost Estimate to calculate the approximate cost of the Azure infrastructure you will use in your deployment. When you finish generating the estimate, click Close.

   This estimate does not include data storage costs.

3. Click Save Automation Artifacts to export an archive file (.zip file) containing information and files you can use in automation scripts to re-create this deployment.
   1. Browse to a location on the local disk where the archive file will be created and type a name for the file.
   2. Choose the type of automation format you will use.
   3. Click Generate to create the file.
4. When all settings are correct and you have saved the files you need, click Finish to create your ArcGIS Server site.

When the site successfully deploys, a link to ArcGIS Server Manager appears in the message box. To connect to Server Manager at a later time, use the URL format https://<DNS_name>.<region>.cloudapp.azure.com/arcgis/manager.

If you created an ArcGIS GeoEvent Server site, open Global Settings in ArcGIS GeoEvent Manager and set the REST Receiver Base URL to the external fully qualified domain name for the site (https://<fqdn>/).

If you want to configure Entra ID as a SAML-based identity provider for your ArcGIS Server site, do so now. See Configure Entra ID in the ArcGIS/idp GitHub repository for instructions.