Deploy ArcGIS Enterprise on Microsoft Azure

You can take advantage of the full ArcGIS Enterprise suite (ArcGIS Server, Portal for ArcGIS, and ArcGIS Data Store) on Microsoft Azure.

You need the following to deploy ArcGIS Enterprise on Microsoft Azure:

• Microsoft Azure subscription
• Esri images
• ArcGIS Enterprise Cloud Builder for Microsoft Azure
• An ArcGIS Enterprise Standard or Advanced license
• Portal for ArcGIS licenses
• An SSL certificate from a certifying authority that you have exported to a .pfx file and for which you have set up CNAME mapping to the cloud service domain you specify in Cloud Builder (optional, but strongly recommended)

Get a Microsoft Azure subscription

A Microsoft Azure subscription and account are required to use Microsoft Azure infrastructure and services. Contact Microsoft to purchase a subscription.

Enable programmatic deployment of ArcGIS images

Before you can use the images from the Azure Marketplace, you must enable the programmatic deployment of ArcGIS. An administrator of your Azure subscription must enable programmatic deployment once for each type of ArcGIS image. This enables all current and future ArcGIS images of that type on the Azure Marketplace.

1. Sign in to the Azure portal.
2. Browse to the ArcGIS image in the Virtual Machine Marketplace.
   1. Click Marketplace on the home screen.
   2. Choose Virtual Machines.
   3. Type arcgis in the search text box.
3. Choose the ArcGIS image you need from the search results.
4. Click Want to deploy programatically? Get Started at the bottom of the pane.

   The Configure Programmatic Deployment pane appears.

5. Read the legal terms and Azure Marketplace Terms. If you accept the conditions, proceed with enabling programmatic deployment.
6. Click Enable for your subscription.
7. Click Save.

Your Azure subscription is now set to use an Esri image from Cloud Builder.

Configure a Windows Domain controller in your Azure environment (optional)

To use a Windows Domain controller with your deployment, you must configure it before you create the deployment.

To use a domain account to run the Windows services used by ArcGIS software, create that domain account before you create your deployment.

Obtain licenses from Esri

To deploy ArcGIS Enterprise, you need an ArcGIS GIS Server license and ArcGIS Enterprise portal license file.

To federate an ArcGIS Image Server, ArcGIS GeoEvent Server, ArcGIS Knowledge Server, or ArcGIS Notebook Server site with your ArcGIS Enterprise deployment, you need appropriate ArcGIS Server role licenses (ArcGIS Image Server, ArcGIS GeoEvent Server, ArcGIS Knowledge Server, or ArcGIS Notebook Server).

Once these licenses are available to your account, you can download them from My Esri.

Install ArcGIS Enterprise Cloud Builder for Microsoft Azure

Download and install ArcGIS Enterprise Cloud Builder for Microsoft Azure 11.4.

Deploy ArcGIS Enterprise

Use ArcGIS Enterprise Cloud Builder for Microsoft Azure to deploy all components of ArcGIS Enterprise.

Steps are organized into subsections to help you use Cloud Builder.

Connect and begin configuration of ArcGIS Enterprise

Start Cloud Builder, sign in to your Microsoft Azure account, and choose to create a deployment.

1. Start ArcGIS Enterprise Cloud Builder for Microsoft Azure.
2. Sign in to Microsoft Azure.

   If you want to use the Microsoft Azure Government cloud and have an Azure Government subscription, check U.S. Government Cloud.

   Note:

   The account you use to connect must be assigned the following roles at a minimum:

   • The Azure Reader role at the subscription scope level
   • The Azure Contributor role at the resource group scope level if you will use resource groups that you create outside Cloud Builder

3. Choose an Entra ID tenant, click Next, choose a subscription in which to create a deployment, and click Next.
4. Ensure that the V2 Sites option is selected, and click Deploy a new site.
5. Choose ArcGIS Enterprise and click Next.

Specify site options

Specify a resource group, choose how many machines to include in the deployment, and choose the virtual machine image that will be used to create the machines. Optionally, you can add a user-assigned managed identity to access Azure Blob storage locations.

1. Choose a resource group or click the Add button to create a resource group for your site.

   A resource group is a container that holds related resources for an application.

   1. Provide an intuitive name for the resource group.

      The name can contain alphanumeric characters, dashes (-), underscores (_), parentheses (()), and dots (.).

   2. Click Check availability to ensure that the name is unique and can be used for your resource group.
   3. Choose a region for the resource group.
   4. Click Create.
   5. Once the resource group is created, click Close.
2. Choose one of the following deployment types, which determine how ArcGIS Enterprise components will be distributed across virtual machines:
   • Multi tier—Each ArcGIS Enterprise component will be deployed on a separate virtual machine to distribute resources.

     Portal for ArcGIS, ArcGIS GIS Server (the hosting server), and ArcGIS Data Store (relational) will each run on their own machine.

     This type is recommended for production deployments.

   • Single tier—All ArcGIS Enterprise components will be created on one Azure machine.

     This deployment type is appropriate for development and testing environments.

     You can add a second machine to this deployment when you get to the Machine Specifications window, in which case a second machine will be added that contains Portal for ArcGIS, ArcGIS GIS Server, and ArcGIS Data Store (relational).

3. To avoid duplication of Azure resource names in resource groups, Cloud Builder allows you to prefix resources with a specified string. Check Prefix Azure Resource Manager (ARM) resource names with and provide up to three alphanumeric characters.

   Cloud Builder automatically populates this value with a random two-character string. To change the string, type a different prefix to add to Azure resource names such as load balancers and availability sets.

   Prefixes must start with an alphabetic character.

   Adding a prefix avoids duplication of resource names and allows you to categorize resources according to your requirements for managing in the Azure portal or billing.

   For disaster recovery configurations, create multiple resource groups with the same prefix.

4. Choose the machine image to use: an image provided by Esri, a managed image, an image in the Azure Compute Gallery, or an image you create.

   The image must exist in the region in which you will create the deployment.

   • To use an Esri image, choose the image from the drop-down list.
   • To use an image from the image list, choose Managed images, and choose the image from the drop-down list.
   • To use a machine image in the Azure Compute Gallery, choose the gallery from the Select gallery drop-down list, choose the machine image from the Select image drop-down list, choose the ArcGIS software version to include on the image from the Select version drop-down list, and choose the Azure region from the Select region list. The region should be the same as where your resource group is deployed.
   • To create an image from a source VHD file, choose Managed images, and do the following:
   1. Click the Add button next to Select image.
   2. Provide a name for the image and click Check availability to ensure that the name is unique.

      The image name can contain only letters, numbers, underscores (_), dots (.), and hyphens (-). The name must start with a letter or number and end with a letter, number, or underscore.

   3. Choose or create a resource group in which to store the image.
   4. Choose the region in which to create the image.

      Use the same region that contains the .vhd file from which you create the image.

   5. For Source disk, click the button to browse to the .vhd file in your storage account. Choose the storage account that contains the file, choose the file, and click OK.

      The storage accounts available on the Select image disk dialog box are based on the region you chose in the previous step.

   6. Choose the type of image to create.

      HDD uses magnetic storage. SSD images use faster, solid-state drives.

   7. For Size, choose the image size.

      The image size determines the minimum size of the operating system disk (C:\) of the virtual machine created from the image. You can increase the size of the provisioned disk for the virtual machine created from the image, but you cannot decrease the size below the image size.

      See the Microsoft Azure documentation for more information about Azure managed disks.

   8. Click Create to create the image.

   Once created, the image is available in the list of images the next time you create a deployment.

5. Optionally, add one or more user-assigned managed identities for authentication purposes when accessing an Azure Blob Storage container used for the configuration store, content directory, or cloud storage data stores.
   1. Click the Add button in the Assign User Assigned Managed Identity section.
   2. Choose the subscription that contains the identity.
   3. Choose the user-assigned managed identity from the Identity drop-down list and click Add.

   Note:

   A user-assigned managed identity is required if you will enable Azure Monitor Log Analytics.

   The Azure Storage Blob Data Owner role and Storage Table Data Contributor role must be assigned to the user-assigned managed identity to access the configuration store.

   If you will use the webgisdr utility installed with Portal for ArcGIS to back up and restore the deployment, assign the Azure Blob Data Storage Owner role to the user-assigned managed identity. See the Microsoft Azure documentation for instructions to assign a role to a user-assigned managed identity.

6. Click Next to proceed to the Networking Options settings.

Set networking options

Choose or create a virtual network, its subnets, and IP address, and define how the site will communicate with external clients.

1. Choose an existing virtual network from the drop-down list or click the Create button to create a virtual network.
2. To create a virtual network using Cloud Builder, do the following:
   1. Provide a name for the virtual network.

      Names must be unique within your Azure subscription.

   2. Click Check availability to ensure that the name you provided is unique.

      If the name is unique, a check mark appears in the Name field.

   3. Choose the range of TCP/IP addresses (the address space class) to be used by your virtual network.

      See the Microsoft documentation for more information about address classes.

   4. Choose the CIDR value from the VM subnet IP count drop-down list to determine the maximum number of addresses to be used in your address space.
   5. Click Create.
   6. Once the virtual network is created, click Close.
3. Choose or create a subnet for your virtual network.

   If you create a subnet, you must provide a unique name and an address range. See the Microsoft Azure documentation for information about virtual network subnet addresses.

4. Choose or create a second subnet for the Application Gateway subnet setting.

   All V2 deployments are accessed through an Azure Application Gateway. Azure Application Gateways require a dedicated subnet.

5. The application gateway requires an IP address provided by Microsoft Azure, and the IP address must have a DNS name associated with it. Use one of the following:
   • Existing public IP—Choose an IP address from the drop-down list.

     If you use an existing public IP address, the IP address must use a standard SKU. See the Microsoft Azure documentation for more information about public IP addresses and SKU.

   • New public IP—Type a name for a public domain that ArcGIS Enterprise Cloud Builder for Microsoft Azure will create.
   • New private IP—Type a name for a private IP address that Cloud Builder will create.

     Note:

     Before you can use this option, you must configure your Azure subscription to use preview features. See the Azure help for information.

     Also, you must configure DNS entries for the private IP that will be allocated dynamically from the Application Gateway subnet before you use this option.

   The domain name is in the format mydomain.<location>.cloudapp.azure.com.

   Domain names must be unique within an Azure region. A green check mark appears if your domain name is unique.

   Note:

   To use a certificate authority-issued SSL certificate, the domain name must match the CNAME mapping you configured for the certificate.

6. In the Outbound VM Connectivity section, choose one of the following options for external communication:
   • Use a Network Address Translaton (NAT) service—To use this option, the NAT service must already exist in your account. Choose the service from the drop-down list.
   • Load balancer—Cloud Builder will create a load balancer to use for outbound communication.

   Read the Microsoft Azure documentation for information about these options.

7. Click Next to proceed to the Certificate Options settings.

Use SSL certificates

For production deployments, use an SSL certificate issued by a certificate authority (CA).

1. Specify the SSL certificate to use for the deployment.
   • Choose Certificate issued by a Certificate Authority to use a CA certificate and, in the Domain name (alias) text box, type the CNAME you mapped to the site domain you created in the steps above. The format of the domain is <domain>.<location>.cloudapp.azure.com.
   • If your ArcGIS Enterprise deployment is for testing purposes only and, therefore, you are not using a CA certificate, choose Self-signed certificate (Automatically generated). Cloud Builder will generate a self-signed certificate for the virtual machines in the deployment. People connecting to your portal will receive warnings that the site is not trusted if you use a self-signed certificate.
2. If you deploy ArcGIS Enterprise in separate regions for disaster recovery, check the box next to Provide secondary domain name and type an alias for the secondary domain in the Secondary domain name (alias) field.

   When you include a secondary domain name, the CA certificate you provide in the next step must include two subject alternative name entries: one for the public deployment and one for the private portal URL of the secondary deployment. Your CNAME mapping must include the secondary deployment URL.

   If you do not check the box next to Provide secondary domain name, the secondary domain name value defaults to the same as the public domain defined for the CA certificate.

3. Choose one of the following to specify the .pfx file that you exported from your certificate:
   • From file—Type or browse to the .pfx file in the Pfx file field, and, in the Password field, type the password configured for the file.
   • From key vault—Specify the Azure key vault where the CA certificate is stored, and choose the certificate file using the Certificate drop-down list.

     Note:

     You can only choose a CA certificate that you uploaded to the key vault using Cloud Builder when you created another deployment. If this is the first time using this certificate, choose the key vault from the drop-down list, click the Create button next to the Certificate drop-down list, and upload the certificate.

4. Click Next to proceed to the Machine Options settings.

Specify machine options

Specify credentials for the virtual machine administrator and enable optional machine settings such as remote desktop access, automatic shutdown, and automatic operating system updates. You can also add the machines to an existing domain in Azure.

Additional options on this Cloud Builder page vary depending on whether you create a single-tier or multiple-tier deployment.

1. Provide a username and password for Machine administrator.

   This is the Windows login you will use to administer the virtual machines in the site, and you will need it when you upgrade the deployment. The same login and password are used for all machines in the site.

   The username must contain three or more characters and contain no spaces, and it cannot be admin or administrator. The password must meet Windows Server complexity requirements.

2. Choose the time zone you want your virtual machines to use.
3. If you have an existing Windows Domain in your Azure environment to which you want to add your machine (or machines), click Domain join options.
   1. On the Domain Join Options dialog box, check the Join existing Windows domain check box.
   2. Provide the name of the Entra ID domain.
   3. Provide the username and password for the domain administrator.
   4. Click Apply.
4. If you check the Enable automatic operating system updates check box, Microsoft Azure will apply updates to the operating systems on your virtual machines.
5. Optionally, check Enable trusted launch to secure the virtual machines in the deployment.

   This option is only available if you use a compute gallery image or Esri image to create the deployment. Refer to the Microsoft Azure documentation for a description of trusted launch functionality.

   You can additionally enable the following options for trusted launch:

   • Enable secure boot
   • Enable vTPM
6. If you do not require access to your deployment during specific hours of the day, you can configure the machines to shut down at a specific time each day. To do this, check the Enable daily automatic shutdown check box and set the shutdown time from the drop-down list.

   The time is in the time zone you chose for the virtual machines.

   Shutting down machines allows you to save money because the machines are not running when you do not need them. However, the machines do not automatically restart; you must restart each machine in the deployment when you need them again. You can restart the machines from Cloud Builder or the Microsoft Azure portal.

7. Optionally, check the Remove extra artifacts and setups from virtual machines to uninstall and delete files for an ArcGIS Enterprise component that is not used.

   Esri imaged contain all ArcGIS Enterprise components. If you have separate machines for Portal for ArcGIS, the hosting server, and ArcGIS Data Store, checking this option will remove the unused components from each machine. For example, ArcGIS Server and ArcGIS Data Store will be removed from the Portal for ArcGIS virtual machines.

8. To directly sign in to your virtual machines, check Enable remote desktop access using a jumpbox host and port 3389.

   In a deployment that contains multiple machines, the remote desktop connection provides access to the file share machine. To access the other machines in the deployment, connect to the file share machine and, from there, use remote desktop connections to the other machines using the machine host names, fully qualified domain names, or IP addresses.

9. Click Next to define locations for system directories.

Define the location of system directories

Choose where to create the portal content directory and the ArcGIS Server configuration store and directories for the hosting server.

1. To keep the directories in a shared directory on a virtual machine, follow these steps:
   1. Choose Store portal content directory, server configuration store and server directories on a file share.
   2. Choose one of the following options for the virtual machine.

      • File share on separate virtual machine—Uses a shared directory on an additional virtual machine that Cloud Builder will create.
      • Existing file share path—Provide the path to a file share on an existing virtual machine.

2. To keep the portal content directory and the ArcGIS Server configuration store in a cloud storage location and the ArcGIS Server directories in a shared directory, follow the steps below:
   1. Choose Store server configuration in cloud storage and the server directories on a file share.
   2. Choose one of the following options for the virtual machine for the ArcGIS Server directories.

      • File share on separate virtual machine—Uses a shared directory on an additional virtual machine that Cloud Builder will create.
      • Existing file share path—Provide the path to a file share on an existing virtual machine.

   3. In the Cloud Storage Options section, choose a storage account from the drop-down list, or click the Create button and define a new storage account.
   4. Choose an authentication type to access the storage account.

      • ServicePrincipal—If you configured a service principal for the account specified in the previous step, provide the tenant ID, client ID, and client secret for the service principal. See the Microsoft Azure help for an explanation of service principals.

        The Azure Storage Blob Data Owner role and Storage Table Data Contributor role must be assigned to the service principal.

      • AccessKey—When you choose this option, Cloud Builder will obtain the access key for the account.
      • UserAssignedIdentity—To use this option, you must have added a user-assigned managed identity when you defined site options. Choose the identity from the drop-down list.

3. Click Next to proceed to the Data Store Options settings.

Set data store options

You must create a relational data store, which is provided through ArcGIS Data Store. By default, an Azure Blob Storage container will also be registered as the deployment's object store.

You can add other types of data stores depending on functionality that you require.

See Apps and functionality that require ArcGIS Data Store in the Portal for ArcGIS administrator guide for help in determining which types of data store you need.

Tip:

If you don't include it now and later decide you need an object store, spatiotemporal big data store, or graph store, you can add them after you create this deployment. See Add an object store to an ArcGIS Enterprise deployment on Microsoft Azure or Add ArcGIS Data Store machines to an ArcGIS Enterprise deployment on Microsoft Azure for instructions.

1. Check the box next to the type or types of data stores to create in addition to the relational data store.
2. To add an object store, follow these steps: click the More options button and choose or create a storage account and choose or create a storage location.
   1. Click the More options button next to the Cloud store location field.
   2. Choose an account from the Storage account drop-down list, or click the Create button next to the Storage account list and create a storage account.
   3. Choose the authentication type to access the storage location.

      • AccessKey—When you choose this option, Cloud Builder will obtain the access key for the account.
      • UserAssignedIdentity—If you choose this option, you must choose one of the identities from the Identity drop-down list. If an identity does not exist, go back to the Site Options settings to add a user-assigned managed identity, and then return to this step.

        The user-assigned managed identity must be assigned to the storage account and must be assigned the Azure Storage Blob Data Owner role.

        Note:

        If you created a storage account in the previous step (b) or created the user-assigned managed identity as part of configuring site options, you must sign in to the Azure portal to configure this before you proceed with creating this deployment.

   4. Specify the location to be used for the object store. You have the following options:

      • Choose an empty folder from the folder list.
      • Click the Create a container button to create an Azure Blob Storage container.

        If you create a container, the object store contents will be stored in the root directory of the container.

   5. Click OK to return to the Register Database, Object Store, or Cloud Stores window.
3. If you're creating a single-tier deployment and including a spatiotemporal big data store, choose whether to create it on a separate virtual machine (which is the recommended option) or on the same machine as the relational data store.

   When you include a graph store, it is always created on a separate virtual machine, even if you create a single-tier deployment.

4. Click Next to proceed to the Machine Specifications settings.

Define machine specifications

Define the number and size of the virtual machines in the deployment.

Additional options on this Cloud Builder window vary depending on whether you create a single-tier or multiple-tier deployment and what data stores you include in the deployment.

1. Check Add secondary machine to add a virtual machine to tier that support a maximum of two machines.

   In multitier deployments, Portal for ArcGIS and the relational data store can include a secondary machine.

   A graph store can include a secondary machine.

   If you're creating a single-tier deployment, you can add a second machine that contains the ArcGIS Enterprise components.

2. If you include a spatiotemporal big data store in the deployment on a machine separate from the relational data store, you can increase the number of machines in the spatiotemporal big data store cluster.

   In this scenario, the cluster must contain at least three machines.

3. Accept default machine names, or type new names.

   Note:

   For disaster recovery configurations of ArcGIS Enterprise, give the primary and secondary deployments an identical name, but place them in separate virtual networks and in separate resource groups that have been assigned the same prefix.

4. To change the type and size of any of the virtual machines, and to add disks to any of the machines, click the Configure Virtual Machine button .

   You can do this for any of the components in the deployment.

   1. On the Configure Virtual Machine pop-up, choose the disk type from the OS disk type drop-down menu.
   2. Choose the machine type, which defines the number of cores and memory available on the machine.
   3. Use the Size of OS disk drop-down menu to choose the size of the root disk on the machine.
   4. Optionally, to add a separate data disk, click the Add a data disk button and define the disk type and size.
5. Click Next to proceed to the License and Credentials settings.

Specify license and credentials

Provide the Portal for ArcGIS and ArcGIS Server license files as well as authentication information for ArcGIS and Windows service administrators.

1. Provide the portal license file and an ArcGIS GIS Server license file to authorize the portal and its hosting server.
   1. Browse to your Portal for ArcGIS license file (.json).
   2. Choose the user type for this portal deployment.

      The type of user you define here determines what apps are available to portal members.

   3. Browse to your ArcGIS GIS Server license file.
2. Type a username and password for the site administrator.

   This will be used for the ArcGIS Server primary administrator account and the Portal for ArcGIS initial administrator account.

3. Type a username and password for ArcGIS Service Account.

   This is the Windows login under which the Portal for ArcGIS, ArcGIS Server, and ArcGIS Data Store services will run.

   If you have an existing Windows domain in your Azure environment and created a domain account to use for this purpose, specify that domain account information for the username and password. You'll join the machines to an existing domain on the next window.

4. Click Next to proceed to the Deployment Options settings.

Specify deployment options

Deployment options include specifying storage locations for deployment artifacts and choosing logging settings.

1. Choose or create a storage account for your deployment. To create a storage account, do the following:
   1. Provide a name for the storage account.

      Names must be unique. Click Check availability to confirm that the storage account name is unique.

   2. Choose the Azure region where your storage will reside.
   3. Choose an existing resource group for the storage account or click the Create button to create one.
   4. Choose the type of redundancy for your storage account: Geo-Redundant, Locally Redundant, or Read-Access Geo-Redundant.

      See Azure Storage redundancy in the Microsoft Azure documentation for a description of each option.

   5. Specify the kind of Azure storage account to use: Storage (a legacy account type), StorageV2 (a basic account type), or BlobStorage (only supports Azure Blob storage).
   6. Once the storage account is created, click Close.
2. Optionally, enable monitoring for the site by checking the box next to Enable monitoring using Azure Monitor Log Analytics.
   1. Choose or create a workspace where log analytics will be stored.
   2. Optionally, check the box next to Enable ArcGIS Server logs that can be transferred to Azure Monitor to copy ArcGIS Server log files to Azure Monitor.
   3. From the Azure monitoring agent identity drop-down list, choose the user-assigned managed identity you specified with the site options.

      This information is required to enable Azure Monitor Log Analytics.

3. Click Next to view a summary of all the options you chose.

Review the summary and deploy

Ensure the deployment contains what you need and create the deployment.

You can also estimate costs for the infrastructure you chose and export the deployment options so you can automate the creation of future deployments.

1. Review the settings in the Summary pane. If anything needs to be changed, click Back to go to the pane where you need to change the information.

   Tip:

   Click Save Summary to save your site configuration information to a text file so you can refer to it for information such as the usernames or machine names.

2. Click Generate cost estimate to calculate the approximate cost of the Azure infrastructure you will use in your deployment. When you finish generating the estimate, click Close.

   This estimate does not include data storage costs.

3. Click Save automation artifacts to export an archive file (.zip file) containing information and files you can use in automation scripts to re-create this deployment.
   1. Browse to a location on the local disk where the archive file will be created and type a name for the file.
   2. Choose the type of automation format you will use.
   3. Click Generate to create the file.
4. When all settings are correct, click Finish to deploy the base ArcGIS Enterprise components.

When the site successfully deploys, a link to the portal appears in the message box. To connect to the portal at a later time, use the URL format https://<DNS_name>.<region>.cloudapp.azure.com/portal/home.

You can configure Entra ID as a SAML-based identity provider for your ArcGIS Enterprise portal if you require it. See Configure Entra ID in the ArcGIS/idp GitHub repository for instructions.