Repository: Azure/bicep-registry-modules
Pull request #5189: feat: speed up azlocal test through image packaged
Author: login: xhy8759
Labels: name: Needs: Triage :mag:
description: Maintainers need to triage still
name: Type: AVM :a: :v: :m:
description: This is an AVM related issue
name: Needs: Core Team :genie:
description: This item needs the AVM Core Team to review it
Created: 2025-05-12T04:44:59Z | Merged: 2025-05-13T06:43:53Z

## Description

<!--
>Thank you for your contribution !
> Please include a summary of the change and which issue is fixed.
> Please also include the context.
> List any dependencies that are required for this change.

Fixes #123
Fixes #456
Closes #123
Closes #456
-->

## Pipeline Reference

<!-- Insert your Pipeline Status Badge below -->

| Pipeline |
| -------- |
|     [![avm.res.azure-stack-hci.cluster](https://github.com/Infrastructure-as-code-Automation/bicep-registry-modules/actions/workflows/avm.res.azure-stack-hci.cluster.yml/badge.svg?branch=hangxu%2Fimage2)](https://github.com/Infrastructure-as-code-Automation/bicep-registry-modules/actions/workflows/avm.res.azure-stack-hci.cluster.yml)     |

## Type of Change

<!-- Use the checkboxes [x] on the options that are relevant. -->

- [ ] Update to CI Environment or utilities (Non-module affecting changes)
- [ ] Azure Verified Module updates:
  - [ ] Bugfix containing backwards-compatible bug fixes, and I have NOT bumped the MAJOR or MINOR version in `version.json`:
    - [ ] Someone has opened a bug report issue, and I have included "Closes #{bug_report_issue_number}" in the PR description.
    - [ ] The bug was found by the module author, and no one has opened an issue to report it yet.
  - [ ] Feature update backwards compatible feature updates, and I have bumped the MINOR version in `version.json`.
  - [ ] Breaking changes and I have bumped the MAJOR version in `version.json`.
  - [ ] Update to documentation

## Checklist

- [ ] I'm sure there are no other open Pull Requests for the same update/change
- [ ] I have run `Set-AVMModule` locally to generate the supporting module files.
- [ ] My corresponding pipelines / checks run clean and green without any errors or warnings

<!--  Please keep up to date with the contribution guide at https://aka.ms/avm/contribute/bicep -->

## Maintainer checklist
- [ ] CI-arbLocalAdminAndDeploymentUserPass



Diff:
diff --git a/avm/res/azure-stack-hci/cluster/README.md b/avm/res/azure-stack-hci/cluster/README.md
index e39c97f0b21..8dc3a6f74f8 100644
--- a/avm/res/azure-stack-hci/cluster/README.md
+++ b/avm/res/azure-stack-hci/cluster/README.md
@@ -48,54 +48,28 @@ module cluster 'br/public:avm/res/azure-stack-hci/cluster:<version>' = {
       clusterNodeNames: '<clusterNodeNames>'
       clusterWitnessStorageAccountName: '<clusterWitnessStorageAccountName>'
       customLocationName: 'ashcmin-location'
-      defaultGateway: '172.20.0.1'
+      defaultGateway: '192.168.1.1'
       deploymentPrefix: '<deploymentPrefix>'
       dnsServers: [
-        '172.20.0.1'
+        '192.168.1.254'
       ]
-      domainFqdn: 'hci.local'
+      domainFqdn: 'jumpstart.local'
       domainOUPath: '<domainOUPath>'
       enableStorageAutoIp: true
-      endingIPAddress: '172.20.0.7'
+      endingIPAddress: '192.168.1.65'
       keyVaultName: '<keyVaultName>'
       networkIntents: [
         {
           adapter: [
-            'mgmt'
+            'FABRIC'
+            'FABRIC2'
           ]
           adapterPropertyOverrides: {
             jumboPacket: '9014'
             networkDirect: 'Disabled'
             networkDirectTechnology: 'iWARP'
           }
-          name: 'management'
-          overrideAdapterProperty: true
-          overrideQosPolicy: false
-          overrideVirtualSwitchConfiguration: false
-          qosPolicyOverrides: {
-            bandwidthPercentageSMB: '50'
-            priorityValue8021ActionCluster: '7'
-            priorityValue8021ActionSMB: '3'
-          }
-          trafficType: [
-            'Management'
-          ]
-          virtualSwitchConfigurationOverrides: {
-            enableIov: 'true'
-            loadBalancingAlgorithm: 'Dynamic'
-          }
-        }
-        {
-          adapter: [
-            'comp0'
-            'comp1'
-          ]
-          adapterPropertyOverrides: {
-            jumboPacket: '9014'
-            networkDirect: 'Disabled'
-            networkDirectTechnology: 'iWARP'
-          }
-          name: 'compute'
+          name: 'ManagementCompute'
           overrideAdapterProperty: true
           overrideQosPolicy: false
           overrideVirtualSwitchConfiguration: false
@@ -106,6 +80,7 @@ module cluster 'br/public:avm/res/azure-stack-hci/cluster:<version>' = {
           }
           trafficType: [
             'Compute'
+            'Management'
           ]
           virtualSwitchConfigurationOverrides: {
             enableIov: 'true'
@@ -114,15 +89,15 @@ module cluster 'br/public:avm/res/azure-stack-hci/cluster:<version>' = {
         }
         {
           adapter: [
-            'smb0'
-            'smb1'
+            'StorageA'
+            'StorageB'
           ]
           adapterPropertyOverrides: {
             jumboPacket: '9014'
             networkDirect: 'Disabled'
             networkDirectTechnology: 'iWARP'
           }
-          name: 'storage'
+          name: 'Storage'
           overrideAdapterProperty: true
           overrideQosPolicy: true
           overrideVirtualSwitchConfiguration: false
@@ -140,17 +115,17 @@ module cluster 'br/public:avm/res/azure-stack-hci/cluster:<version>' = {
           }
         }
       ]
-      startingIPAddress: '172.20.0.2'
+      startingIPAddress: '192.168.1.55'
       storageConnectivitySwitchless: false
       storageNetworks: [
         {
-          adapterName: 'smb0'
-          name: 'StorageNetwork0'
+          adapterName: 'StorageA'
+          name: 'Storage1Network'
           vlan: '711'
         }
         {
-          adapterName: 'smb1'
-          name: 'StorageNetwork1'
+          adapterName: 'StorageB'
+          name: 'Storage2Network'
           vlan: '712'
         }
       ]
@@ -162,7 +137,7 @@ module cluster 'br/public:avm/res/azure-stack-hci/cluster:<version>' = {
     deploymentUser: 'deployUser'
     deploymentUserPassword: '<deploymentUserPassword>'
     localAdminPassword: '<localAdminPassword>'
-    localAdminUser: 'admin-hci'
+    localAdminUser: 'Administrator'
     servicePrincipalId: '<servicePrincipalId>'
     servicePrincipalSecret: '<servicePrincipalSecret>'
   }
@@ -187,27 +162,28 @@ module cluster 'br/public:avm/res/azure-stack-hci/cluster:<version>' = {
         "clusterNodeNames": "<clusterNodeNames>",
         "clusterWitnessStorageAccountName": "<clusterWitnessStorageAccountName>",
         "customLocationName": "ashcmin-location",
-        "defaultGateway": "172.20.0.1",
+        "defaultGateway": "192.168.1.1",
         "deploymentPrefix": "<deploymentPrefix>",
         "dnsServers": [
-          "172.20.0.1"
+          "192.168.1.254"
         ],
-        "domainFqdn": "hci.local",
+        "domainFqdn": "jumpstart.local",
         "domainOUPath": "<domainOUPath>",
         "enableStorageAutoIp": true,
-        "endingIPAddress": "172.20.0.7",
+        "endingIPAddress": "192.168.1.65",
         "keyVaultName": "<keyVaultName>",
         "networkIntents": [
           {
             "adapter": [
-              "mgmt"
+              "FABRIC",
+              "FABRIC2"
             ],
             "adapterPropertyOverrides": {
               "jumboPacket": "9014",
               "networkDirect": "Disabled",
               "networkDirectTechnology": "iWARP"
             },
-            "name": "management",
+            "name": "ManagementCompute",
             "overrideAdapterProperty": true,
             "overrideQosPolicy": false,
             "overrideVirtualSwitchConfiguration": false,
@@ -217,6 +193,7 @@ module cluster 'br/public:avm/res/azure-stack-hci/cluster:<version>' = {
               "priorityValue8021ActionSMB": "3"
             },
             "trafficType": [
+              "Compute",
               "Management"
             ],
             "virtualSwitchConfigurationOverrides": {
@@ -226,42 +203,15 @@ module cluster 'br/public:avm/res/azure-stack-hci/cluster:<version>' = {
           },
           {
             "adapter": [
-              "comp0",
-              "comp1"
+              "StorageA",
+              "StorageB"
             ],
             "adapterPropertyOverrides": {
               "jumboPacket": "9014",
               "networkDirect": "Disabled",
               "networkDirectTechnology": "iWARP"
             },
-            "name": "compute",
-            "overrideAdapterProperty": true,
-            "overrideQosPolicy": false,
-            "overrideVirtualSwitchConfiguration": false,
-            "qosPolicyOverrides": {
-              "bandwidthPercentageSMB": "50",
-              "priorityValue8021ActionCluster": "7",
-              "priorityValue8021ActionSMB": "3"
-            },
-            "trafficType": [
-              "Compute"
-            ],
-            "virtualSwitchConfigurationOverrides": {
-              "enableIov": "true",
-              "loadBalancingAlgorithm": "Dynamic"
-            }
-          },
-          {
-            "adapter": [
-              "smb0",
-              "smb1"
-            ],
-            "adapterPropertyOverrides": {
-              "jumboPacket": "9014",
-              "networkDirect": "Disabled",
-              "networkDirectTechnology": "iWARP"
-            },
-            "name": "storage",
+            "name": "Storage",
             "overrideAdapterProperty": true,
             "overrideQosPolicy": true,
             "overrideVirtualSwitchConfiguration": false,
@@ -279,17 +229,17 @@ module cluster 'br/public:avm/res/azure-stack-hci/cluster:<version>' = {
             }
           }
         ],
-        "startingIPAddress": "172.20.0.2",
+        "startingIPAddress": "192.168.1.55",
         "storageConnectivitySwitchless": false,
         "storageNetworks": [
           {
-            "adapterName": "smb0",
-            "name": "StorageNetwork0",
+            "adapterName": "StorageA",
+            "name": "Storage1Network",
             "vlan": "711"
           },
           {
-            "adapterName": "smb1",
-            "name": "StorageNetwork1",
+            "adapterName": "StorageB",
+            "name": "Storage2Network",
             "vlan": "712"
           }
         ],
@@ -313,7 +263,7 @@ module cluster 'br/public:avm/res/azure-stack-hci/cluster:<version>' = {
       "value": "<localAdminPassword>"
     },
     "localAdminUser": {
-      "value": "admin-hci"
+      "value": "Administrator"
     },
     "servicePrincipalId": {
       "value": "<servicePrincipalId>"
@@ -340,54 +290,28 @@ param deploymentSettings = {
   clusterNodeNames: '<clusterNodeNames>'
   clusterWitnessStorageAccountName: '<clusterWitnessStorageAccountName>'
   customLocationName: 'ashcmin-location'
-  defaultGateway: '172.20.0.1'
+  defaultGateway: '192.168.1.1'
   deploymentPrefix: '<deploymentPrefix>'
   dnsServers: [
-    '172.20.0.1'
+    '192.168.1.254'
   ]
-  domainFqdn: 'hci.local'
+  domainFqdn: 'jumpstart.local'
   domainOUPath: '<domainOUPath>'
   enableStorageAutoIp: true
-  endingIPAddress: '172.20.0.7'
+  endingIPAddress: '192.168.1.65'
   keyVaultName: '<keyVaultName>'
   networkIntents: [
     {
       adapter: [
-        'mgmt'
-      ]
-      adapterPropertyOverrides: {
-        jumboPacket: '9014'
-        networkDirect: 'Disabled'
-        networkDirectTechnology: 'iWARP'
-      }
-      name: 'management'
-      overrideAdapterProperty: true
-      overrideQosPolicy: false
-      overrideVirtualSwitchConfiguration: false
-      qosPolicyOverrides: {
-        bandwidthPercentageSMB: '50'
-        priorityValue8021ActionCluster: '7'
-        priorityValue8021ActionSMB: '3'
-      }
-      trafficType: [
-        'Management'
-      ]
-      virtualSwitchConfigurationOverrides: {
-        enableIov: 'true'
-        loadBalancingAlgorithm: 'Dynamic'
-      }
-    }
-    {
-      adapter: [
-        'comp0'
-        'comp1'
+        'FABRIC'
+        'FABRIC2'
       ]
       adapterPropertyOverrides: {
         jumboPacket: '9014'
         networkDirect: 'Disabled'
         networkDirectTechnology: 'iWARP'
       }
-      name: 'compute'
+      name: 'ManagementCompute'
       overrideAdapterProperty: true
       overrideQosPolicy: false
       overrideVirtualSwitchConfiguration: false
@@ -398,6 +322,7 @@ param deploymentSettings = {
       }
       trafficType: [
         'Compute'
+        'Management'
       ]
       virtualSwitchConfigurationOverrides: {
         enableIov: 'true'
@@ -406,15 +331,15 @@ param deploymentSettings = {
     }
     {
       adapter: [
-        'smb0'
-        'smb1'
+        'StorageA'
+        'StorageB'
       ]
       adapterPropertyOverrides: {
         jumboPacket: '9014'
         networkDirect: 'Disabled'
         networkDirectTechnology: 'iWARP'
       }
-      name: 'storage'
+      name: 'Storage'
       overrideAdapterProperty: true
       overrideQosPolicy: true
       overrideVirtualSwitchConfiguration: false
@@ -432,17 +357,17 @@ param deploymentSettings = {
       }
     }
   ]
-  startingIPAddress: '172.20.0.2'
+  startingIPAddress: '192.168.1.55'
   storageConnectivitySwitchless: false
   storageNetworks: [
     {
-      adapterName: 'smb0'
-      name: 'StorageNetwork0'
+      adapterName: 'StorageA'
+      name: 'Storage1Network'
       vlan: '711'
     }
     {
-      adapterName: 'smb1'
-      name: 'StorageNetwork1'
+      adapterName: 'StorageB'
+      name: 'Storage2Network'
       vlan: '712'
     }
   ]
@@ -454,7 +379,7 @@ param name = '<name>'
 param deploymentUser = 'deployUser'
 param deploymentUserPassword = '<deploymentUserPassword>'
 param localAdminPassword = '<localAdminPassword>'
-param localAdminUser = 'admin-hci'
+param localAdminUser = 'Administrator'
 param servicePrincipalId = '<servicePrincipalId>'
 param servicePrincipalSecret = '<servicePrincipalSecret>'
 ```
@@ -482,55 +407,29 @@ module cluster 'br/public:avm/res/azure-stack-hci/cluster:<version>' = {
       clusterNodeNames: '<clusterNodeNames>'
       clusterWitnessStorageAccountName: '<clusterWitnessStorageAccountName>'
       customLocationName: 'ashcwaf-location'
-      defaultGateway: '172.20.0.1'
+      defaultGateway: '192.168.1.1'
       deploymentPrefix: '<deploymentPrefix>'
       dnsServers: [
-        '172.20.0.1'
+        '192.168.1.254'
       ]
-      domainFqdn: 'hci.local'
+      domainFqdn: 'jumpstart.local'
       domainOUPath: '<domainOUPath>'
       driftControlEnforced: true
       enableStorageAutoIp: true
-      endingIPAddress: '172.20.0.7'
+      endingIPAddress: '192.168.1.65'
       keyVaultName: '<keyVaultName>'
       networkIntents: [
         {
           adapter: [
-            'mgmt'
+            'FABRIC'
+            'FABRIC2'
           ]
           adapterPropertyOverrides: {
             jumboPacket: '9014'
             networkDirect: 'Disabled'
             networkDirectTechnology: 'iWARP'
           }
-          name: 'management'
-          overrideAdapterProperty: true
-          overrideQosPolicy: false
-          overrideVirtualSwitchConfiguration: false
-          qosPolicyOverrides: {
-            bandwidthPercentageSMB: '50'
-            priorityValue8021ActionCluster: '7'
-            priorityValue8021ActionSMB: '3'
-          }
-          trafficType: [
-            'Management'
-          ]
-          virtualSwitchConfigurationOverrides: {
-            enableIov: 'true'
-            loadBalancingAlgorithm: 'Dynamic'
-          }
-        }
-        {
-          adapter: [
-            'comp0'
-            'comp1'
-          ]
-          adapterPropertyOverrides: {
-            jumboPacket: '9014'
-            networkDirect: 'Disabled'
-            networkDirectTechnology: 'iWARP'
-          }
-          name: 'compute'
+          name: 'ManagementCompute'
           overrideAdapterProperty: true
           overrideQosPolicy: false
           overrideVirtualSwitchConfiguration: false
@@ -541,6 +440,7 @@ module cluster 'br/public:avm/res/azure-stack-hci/cluster:<version>' = {
           }
           trafficType: [
             'Compute'
+            'Management'
           ]
           virtualSwitchConfigurationOverrides: {
             enableIov: 'true'
@@ -549,15 +449,15 @@ module cluster 'br/public:avm/res/azure-stack-hci/cluster:<version>' = {
         }
         {
           adapter: [
-            'smb0'
-            'smb1'
+            'StorageA'
+            'StorageB'
           ]
           adapterPropertyOverrides: {
             jumboPacket: '9014'
             networkDirect: 'Disabled'
             networkDirectTechnology: 'iWARP'
           }
-          name: 'storage'
+          name: 'Storage'
           overrideAdapterProperty: true
           overrideQosPolicy: true
           overrideVirtualSwitchConfiguration: false
@@ -578,17 +478,17 @@ module cluster 'br/public:avm/res/azure-stack-hci/cluster:<version>' = {
       sideChannelMitigationEnforced: true
       smbClusterEncryption: true
       smbSigningEnforced: true
-      startingIPAddress: '172.20.0.2'
+      startingIPAddress: '192.168.1.55'
       storageConnectivitySwitchless: false
       storageNetworks: [
         {
-          adapterName: 'smb0'
-          name: 'StorageNetwork0'
+          adapterName: 'StorageA'
+          name: 'Storage1Network'
           vlan: '711'
         }
         {
-          adapterName: 'smb1'
-          name: 'StorageNetwork1'
+          adapterName: 'StorageB'
+          name: 'Storage2Network'
           vlan: '712'
         }
       ]
@@ -600,7 +500,7 @@ module cluster 'br/public:avm/res/azure-stack-hci/cluster:<version>' = {
     deploymentUser: 'deployUser'
     deploymentUserPassword: '<deploymentUserPassword>'
     localAdminPassword: '<localAdminPassword>'
-    localAdminUser: 'admin-hci'
+    localAdminUser: 'Administrator'
     servicePrincipalId: '<servicePrincipalId>'
     servicePrincipalSecret: '<servicePrincipalSecret>'
     tags: {
@@ -632,28 +532,29 @@ module cluster 'br/public:avm/res/azure-stack-hci/cluster:<version>' = {
         "clusterNodeNames": "<clusterNodeNames>",
         "clusterWitnessStorageAccountName": "<clusterWitnessStorageAccountName>",
         "customLocationName": "ashcwaf-location",
-        "defaultGateway": "172.20.0.1",
+        "defaultGateway": "192.168.1.1",
         "deploymentPrefix": "<deploymentPrefix>",
         "dnsServers": [
-          "172.20.0.1"
+          "192.168.1.254"
         ],
-        "domainFqdn": "hci.local",
+        "domainFqdn": "jumpstart.local",
         "domainOUPath": "<domainOUPath>",
         "driftControlEnforced": true,
         "enableStorageAutoIp": true,
-        "endingIPAddress": "172.20.0.7",
+        "endingIPAddress": "192.168.1.65",
         "keyVaultName": "<keyVaultName>",
         "networkIntents": [
           {
             "adapter": [
-              "mgmt"
+              "FABRIC",
+              "FABRIC2"
             ],
             "adapterPropertyOverrides": {
               "jumboPacket": "9014",
               "networkDirect": "Disabled",
               "networkDirectTechnology": "iWARP"
             },
-            "name": "management",
+            "name": "ManagementCompute",
             "overrideAdapterProperty": true,
             "overrideQosPolicy": false,
             "overrideVirtualSwitchConfiguration": false,
@@ -663,6 +564,7 @@ module cluster 'br/public:avm/res/azure-stack-hci/cluster:<version>' = {
               "priorityValue8021ActionSMB": "3"
             },
             "trafficType": [
+              "Compute",
               "Management"
             ],
             "virtualSwitchConfigurationOverrides": {
@@ -672,42 +574,15 @@ module cluster 'br/public:avm/res/azure-stack-hci/cluster:<version>' = {
           },
           {
             "adapter": [
-              "comp0",
-              "comp1"
+              "StorageA",
+              "StorageB"
             ],
             "adapterPropertyOverrides": {
               "jumboPacket": "9014",
               "networkDirect": "Disabled",
               "networkDirectTechnology": "iWARP"
             },
-            "name": "compute",
-            "overrideAdapterProperty": true,
-            "overrideQosPolicy": false,
-            "overrideVirtualSwitchConfiguration": false,
-            "qosPolicyOverrides": {
-              "bandwidthPercentageSMB": "50",
-              "priorityValue8021ActionCluster": "7",
-              "priorityValue8021ActionSMB": "3"
-            },
-            "trafficType": [
-              "Compute"
-            ],
-            "virtualSwitchConfigurationOverrides": {
-              "enableIov": "true",
-              "loadBalancingAlgorithm": "Dynamic"
-            }
-          },
-          {
-            "adapter": [
-              "smb0",
-              "smb1"
-            ],
-            "adapterPropertyOverrides": {
-              "jumboPacket": "9014",
-              "networkDirect": "Disabled",
-              "networkDirectTechnology": "iWARP"
-            },
-            "name": "storage",
+            "name": "Storage",
             "overrideAdapterProperty": true,
             "overrideQosPolicy": true,
             "overrideVirtualSwitchConfiguration": false,
@@ -728,17 +603,17 @@ module cluster 'br/public:avm/res/azure-stack-hci/cluster:<version>' = {
         "sideChannelMitigationEnforced": true,
         "smbClusterEncryption": true,
         "smbSigningEnforced": true,
-        "startingIPAddress": "172.20.0.2",
+        "startingIPAddress": "192.168.1.55",
         "storageConnectivitySwitchless": false,
         "storageNetworks": [
           {
-            "adapterName": "smb0",
-            "name": "StorageNetwork0",
+            "adapterName": "StorageA",
+            "name": "Storage1Network",
             "vlan": "711"
           },
           {
-            "adapterName": "smb1",
-            "name": "StorageNetwork1",
+            "adapterName": "StorageB",
+            "name": "Storage2Network",
             "vlan": "712"
           }
         ],
@@ -762,7 +637,7 @@ module cluster 'br/public:avm/res/azure-stack-hci/cluster:<version>' = {
       "value": "<localAdminPassword>"
     },
     "localAdminUser": {
-      "value": "admin-hci"
+      "value": "Administrator"
     },
     "servicePrincipalId": {
       "value": "<servicePrincipalId>"
@@ -798,55 +673,29 @@ param deploymentSettings = {
   clusterNodeNames: '<clusterNodeNames>'
   clusterWitnessStorageAccountName: '<clusterWitnessStorageAccountName>'
   customLocationName: 'ashcwaf-location'
-  defaultGateway: '172.20.0.1'
+  defaultGateway: '192.168.1.1'
   deploymentPrefix: '<deploymentPrefix>'
   dnsServers: [
-    '172.20.0.1'
+    '192.168.1.254'
   ]
-  domainFqdn: 'hci.local'
+  domainFqdn: 'jumpstart.local'
   domainOUPath: '<domainOUPath>'
   driftControlEnforced: true
   enableStorageAutoIp: true
-  endingIPAddress: '172.20.0.7'
+  endingIPAddress: '192.168.1.65'
   keyVaultName: '<keyVaultName>'
   networkIntents: [
     {
       adapter: [
-        'mgmt'
-      ]
-      adapterPropertyOverrides: {
-        jumboPacket: '9014'
-        networkDirect: 'Disabled'
-        networkDirectTechnology: 'iWARP'
-      }
-      name: 'management'
-      overrideAdapterProperty: true
-      overrideQosPolicy: false
-      overrideVirtualSwitchConfiguration: false
-      qosPolicyOverrides: {
-        bandwidthPercentageSMB: '50'
-        priorityValue8021ActionCluster: '7'
-        priorityValue8021ActionSMB: '3'
-      }
-      trafficType: [
-        'Management'
-      ]
-      virtualSwitchConfigurationOverrides: {
-        enableIov: 'true'
-        loadBalancingAlgorithm: 'Dynamic'
-      }
-    }
-    {
-      adapter: [
-        'comp0'
-        'comp1'
+        'FABRIC'
+        'FABRIC2'
       ]
       adapterPropertyOverrides: {
         jumboPacket: '9014'
         networkDirect: 'Disabled'
         networkDirectTechnology: 'iWARP'
       }
-      name: 'compute'
+      name: 'ManagementCompute'
       overrideAdapterProperty: true
       overrideQosPolicy: false
       overrideVirtualSwitchConfiguration: false
@@ -857,6 +706,7 @@ param deploymentSettings = {
       }
       trafficType: [
         'Compute'
+        'Management'
       ]
       virtualSwitchConfigurationOverrides: {
         enableIov: 'true'
@@ -865,15 +715,15 @@ param deploymentSettings = {
     }
     {
       adapter: [
-        'smb0'
-        'smb1'
+        'StorageA'
+        'StorageB'
       ]
       adapterPropertyOverrides: {
         jumboPacket: '9014'
         networkDirect: 'Disabled'
         networkDirectTechnology: 'iWARP'
       }
-      name: 'storage'
+      name: 'Storage'
       overrideAdapterProperty: true
       overrideQosPolicy: true
       overrideVirtualSwitchConfiguration: false
@@ -894,17 +744,17 @@ param deploymentSettings = {
   sideChannelMitigationEnforced: true
   smbClusterEncryption: true
   smbSigningEnforced: true
-  startingIPAddress: '172.20.0.2'
+  startingIPAddress: '192.168.1.55'
   storageConnectivitySwitchless: false
   storageNetworks: [
     {
-      adapterName: 'smb0'
-      name: 'StorageNetwork0'
+      adapterName: 'StorageA'
+      name: 'Storage1Network'
       vlan: '711'
     }
     {
-      adapterName: 'smb1'
-      name: 'StorageNetwork1'
+      adapterName: 'StorageB'
+      name: 'Storage2Network'
       vlan: '712'
     }
   ]
@@ -916,7 +766,7 @@ param name = '<name>'
 param deploymentUser = 'deployUser'
 param deploymentUserPassword = '<deploymentUserPassword>'
 param localAdminPassword = '<localAdminPassword>'
-param localAdminUser = 'admin-hci'
+param localAdminUser = 'Administrator'
 param servicePrincipalId = '<servicePrincipalId>'
 param servicePrincipalSecret = '<servicePrincipalSecret>'
 param tags = {
diff --git a/avm/res/azure-stack-hci/cluster/deployment-setting/main.json b/avm/res/azure-stack-hci/cluster/deployment-setting/main.json
index 9fd28d9b156..de22fea05e8 100644
--- a/avm/res/azure-stack-hci/cluster/deployment-setting/main.json
+++ b/avm/res/azure-stack-hci/cluster/deployment-setting/main.json
@@ -5,8 +5,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.33.93.31351",
-      "templateHash": "12398547587936092834"
+      "version": "0.35.1.17967",
+      "templateHash": "15018461677267759264"
     },
     "name": "Azure Stack HCI Cluster Deployment Settings",
     "description": "This module deploys an Azure Stack HCI Cluster Deployment Settings resource."
diff --git a/avm/res/azure-stack-hci/cluster/main.bicep b/avm/res/azure-stack-hci/cluster/main.bicep
index ebc36adc36b..0048b5b5d93 100644
--- a/avm/res/azure-stack-hci/cluster/main.bicep
+++ b/avm/res/azure-stack-hci/cluster/main.bicep
@@ -513,16 +513,3 @@ type deploymentSettingsType = {
   @description('Required. The name of the key vault to be used for storing secrets for the HCI cluster. This currently needs to be unique per HCI cluster.')
   keyVaultName: string
 }
-
-@export()
-@description('Key vault secret names interface')
-type KeyVaultSecretNames = {
-  @description('Required. The name of the Azure Stack HCI LCM user credential secret.')
-  azureStackLCMUserCredential: string
-  @description('Required. The name of the Azure Stack HCI local admin credential secret.')
-  localAdminCredential: string
-  @description('Required. The name of the Azure Stack HCI default ARB application secret.')
-  defaultARBApplication: string
-  @description('Required. The name of the Azure Stack HCI witness storage key secret.')
-  witnessStorageKey: string
-}
diff --git a/avm/res/azure-stack-hci/cluster/main.json b/avm/res/azure-stack-hci/cluster/main.json
index 875c1cb9587..e4fca292531 100644
--- a/avm/res/azure-stack-hci/cluster/main.json
+++ b/avm/res/azure-stack-hci/cluster/main.json
@@ -5,8 +5,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.33.93.31351",
-      "templateHash": "956420421248843753"
+      "version": "0.35.1.17967",
+      "templateHash": "16978206902562336432"
     },
     "name": "Azure Stack HCI Cluster",
     "description": "This module deploys an Azure Stack HCI Cluster on the provided Arc Machines."
@@ -499,39 +499,6 @@
         }
       }
     },
-    "KeyVaultSecretNames": {
-      "type": "object",
-      "properties": {
-        "azureStackLCMUserCredential": {
-          "type": "string",
-          "metadata": {
-            "description": "Required. The name of the Azure Stack HCI LCM user credential secret."
-          }
-        },
-        "localAdminCredential": {
-          "type": "string",
-          "metadata": {
-            "description": "Required. The name of the Azure Stack HCI local admin credential secret."
-          }
-        },
-        "defaultARBApplication": {
-          "type": "string",
-          "metadata": {
-            "description": "Required. The name of the Azure Stack HCI default ARB application secret."
-          }
-        },
-        "witnessStorageKey": {
-          "type": "string",
-          "metadata": {
-            "description": "Required. The name of the Azure Stack HCI witness storage key secret."
-          }
-        }
-      },
-      "metadata": {
-        "__bicep_export!": true,
-        "description": "Key vault secret names interface"
-      }
-    },
     "roleAssignmentType": {
       "type": "object",
       "properties": {
@@ -973,8 +940,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.33.93.31351",
-              "templateHash": "13439816736266620515"
+              "version": "0.35.1.17967",
+              "templateHash": "17734334454941239273"
             }
           },
           "parameters": {
@@ -1192,7 +1159,7 @@
               "name": "[format('{0}/{1}', parameters('keyVaultName'), format('{0}-WitnessStorageKey-{1}', parameters('clusterName'), parameters('cloudId')))]",
               "properties": {
                 "contentType": "[parameters('witnessStoragekeyContentType')]",
-                "value": "[base64(listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('witnessStorageAccountSubscriptionId'), parameters('witnessStorageAccountResourceGroup')), 'Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2023-01-01').keys[0].value)]",
+                "value": "[base64(listKeys('witnessStorageAccount', '2023-01-01').keys[0].value)]",
                 "attributes": {
                   "enabled": true
                 }
@@ -1350,8 +1317,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.33.93.31351",
-              "templateHash": "12398547587936092834"
+              "version": "0.35.1.17967",
+              "templateHash": "15018461677267759264"
             },
             "name": "Azure Stack HCI Cluster Deployment Settings",
             "description": "This module deploys an Azure Stack HCI Cluster Deployment Settings resource."
diff --git a/avm/res/azure-stack-hci/cluster/tests/e2e/defaults/main.test.bicep b/avm/res/azure-stack-hci/cluster/tests/e2e/defaults/main.test.bicep
index 6ad9c7181d0..cbf9c73e995 100644
--- a/avm/res/azure-stack-hci/cluster/tests/e2e/defaults/main.test.bicep
+++ b/avm/res/azure-stack-hci/cluster/tests/e2e/defaults/main.test.bicep
@@ -13,9 +13,9 @@ param serviceShort string = 'ashcmin'
 @description('Optional. A token to inject into the name of each resource.')
 param namePrefix string = '#_namePrefix_#'
 
-@description('Optional. The password of the LCM deployment user and local administrator accounts.')
+@description('Required. The password of the LCM deployment user and local administrator accounts.')
 @secure()
-param localAdminAndDeploymentUserPass string = newGuid()
+param arbLocalAdminAndDeploymentUserPass string = ''
 
 @description('Required. The app ID of the service principal used for the Azure Stack HCI Resource Bridge deployment.')
 @secure()
@@ -45,7 +45,7 @@ resource resourceGroup 'Microsoft.Resources/resourceGroups@2024-03-01' = {
   location: enforcedLocation
 }
 
-module nestedDependencies '../../../../../../../utilities/e2e-template-assets/module-specific/azure-stack-hci/dependencies/defaults-dependencies.bicep' = {
+module nestedDependencies '../../../../../../../utilities/e2e-template-assets/module-specific/azure-stack-hci/dependencies/dependencies.bicep' = {
   name: '${uniqueString(deployment().name, enforcedLocation)}-test-nestedDependencies-${serviceShort}'
   scope: resourceGroup
   params: {
@@ -60,15 +60,13 @@ module nestedDependencies '../../../../../../../utilities/e2e-template-assets/mo
     virtualNetworkName: 'dep-${namePrefix}-vnet-${serviceShort}'
     networkSecurityGroupName: 'dep-${namePrefix}-nsg-${serviceShort}'
     networkInterfaceName: 'dep-${namePrefix}-mice-${serviceShort}'
-    diskNamePrefix: 'dep-${namePrefix}-disk-${serviceShort}'
     virtualMachineName: 'dep-${namePrefix}-vm-${serviceShort}'
-    waitDeploymentScriptPrefixName: 'dep-${namePrefix}-wds-${serviceShort}'
     arbDeploymentAppId: arbDeploymentAppId
     arbDeploymentServicePrincipalSecret: arbDeploymentServicePrincipalSecret
     arbDeploymentSPObjectId: arbDeploymentSPObjectId
-    deploymentUserPassword: localAdminAndDeploymentUserPass
-    hciResourceProviderObjectId: hciResourceProviderObjectId
-    localAdminPassword: localAdminAndDeploymentUserPass
+    deploymentUserPassword: arbLocalAdminAndDeploymentUserPass
+    localAdminPassword: arbLocalAdminAndDeploymentUserPass
+    domainAdminPassword: arbLocalAdminAndDeploymentUserPass
     location: enforcedLocation
   }
 }
@@ -79,9 +77,9 @@ module testDeployment '../../../main.bicep' = {
   params: {
     name: nestedDependencies.outputs.clusterName
     deploymentUser: 'deployUser'
-    deploymentUserPassword: localAdminAndDeploymentUserPass
-    localAdminUser: 'admin-hci'
-    localAdminPassword: localAdminAndDeploymentUserPass
+    deploymentUserPassword: arbLocalAdminAndDeploymentUserPass
+    localAdminUser: 'Administrator'
+    localAdminPassword: arbLocalAdminAndDeploymentUserPass
     servicePrincipalId: arbDeploymentAppId
     servicePrincipalSecret: arbDeploymentServicePrincipalSecret
     hciResourceProviderObjectId: hciResourceProviderObjectId
@@ -89,41 +87,22 @@ module testDeployment '../../../main.bicep' = {
       customLocationName: '${namePrefix}${serviceShort}-location'
       clusterNodeNames: nestedDependencies.outputs.clusterNodeNames
       clusterWitnessStorageAccountName: nestedDependencies.outputs.clusterWitnessStorageAccountName
-      defaultGateway: '172.20.0.1'
+      defaultGateway: '192.168.1.1'
       deploymentPrefix: 'a${take(uniqueString(namePrefix, serviceShort), 7)}' // ensure deployment prefix starts with a letter to match '^(?=.{1,8}$)([a-zA-Z])(\-?[a-zA-Z\d])*$'
-      dnsServers: ['172.20.0.1']
-      domainFqdn: 'hci.local'
+      dnsServers: ['192.168.1.254']
+      domainFqdn: 'jumpstart.local'
       domainOUPath: nestedDependencies.outputs.domainOUPath
-      startingIPAddress: '172.20.0.2'
-      endingIPAddress: '172.20.0.7'
+      startingIPAddress: '192.168.1.55'
+      endingIPAddress: '192.168.1.65'
       enableStorageAutoIp: true
       keyVaultName: nestedDependencies.outputs.keyVaultName
       networkIntents: [
         {
-          adapter: ['mgmt']
-          name: 'management'
-          overrideAdapterProperty: true
-          adapterPropertyOverrides: {
-            jumboPacket: '9014'
-            networkDirect: 'Disabled'
-            networkDirectTechnology: 'iWARP'
-          }
-          overrideQosPolicy: false
-          qosPolicyOverrides: {
-            bandwidthPercentageSMB: '50'
-            priorityValue8021ActionCluster: '7'
-            priorityValue8021ActionSMB: '3'
-          }
-          overrideVirtualSwitchConfiguration: false
-          virtualSwitchConfigurationOverrides: {
-            enableIov: 'true'
-            loadBalancingAlgorithm: 'Dynamic'
-          }
-          trafficType: ['Management']
-        }
-        {
-          adapter: ['comp0', 'comp1']
-          name: 'compute'
+          adapter: [
+            'FABRIC'
+            'FABRIC2'
+          ]
+          name: 'ManagementCompute'
           overrideAdapterProperty: true
           adapterPropertyOverrides: {
             jumboPacket: '9014'
@@ -141,11 +120,17 @@ module testDeployment '../../../main.bicep' = {
             enableIov: 'true'
             loadBalancingAlgorithm: 'Dynamic'
           }
-          trafficType: ['Compute']
+          trafficType: [
+            'Management'
+            'Compute'
+          ]
         }
         {
-          adapter: ['smb0', 'smb1']
-          name: 'storage'
+          adapter: [
+            'StorageA'
+            'StorageB'
+          ]
+          name: 'Storage'
           overrideAdapterProperty: true
           adapterPropertyOverrides: {
             jumboPacket: '9014'
@@ -169,13 +154,13 @@ module testDeployment '../../../main.bicep' = {
       storageConnectivitySwitchless: false
       storageNetworks: [
         {
-          name: 'StorageNetwork0'
-          adapterName: 'smb0'
+          name: 'Storage1Network'
+          adapterName: 'StorageA'
           vlan: '711'
         }
         {
-          name: 'StorageNetwork1'
-          adapterName: 'smb1'
+          name: 'Storage2Network'
+          adapterName: 'StorageB'
           vlan: '712'
         }
       ]
diff --git a/avm/res/azure-stack-hci/cluster/tests/e2e/waf-aligned/main.test.bicep b/avm/res/azure-stack-hci/cluster/tests/e2e/waf-aligned/main.test.bicep
index fe0c3a36ac9..bcb9fd36dd0 100644
--- a/avm/res/azure-stack-hci/cluster/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/azure-stack-hci/cluster/tests/e2e/waf-aligned/main.test.bicep
@@ -13,9 +13,9 @@ param serviceShort string = 'ashcwaf'
 @description('Optional. A token to inject into the name of each resource.')
 param namePrefix string = '#_namePrefix_#'
 
-@description('Optional. The password of the LCM deployment user and local administrator accounts.')
+@description('Required. The password of the LCM deployment user and local administrator accounts.')
 @secure()
-param localAdminAndDeploymentUserPass string = newGuid()
+param arbLocalAdminAndDeploymentUserPass string = ''
 
 @description('Required. The app ID of the service principal used for the Azure Stack HCI Resource Bridge deployment.')
 @secure()
@@ -45,7 +45,7 @@ resource resourceGroup 'Microsoft.Resources/resourceGroups@2024-03-01' = {
   location: enforcedLocation
 }
 
-module nestedDependencies '../../../../../../../utilities/e2e-template-assets/module-specific/azure-stack-hci/dependencies/waf-dependencies.bicep' = {
+module nestedDependencies '../../../../../../../utilities/e2e-template-assets/module-specific/azure-stack-hci/dependencies/dependencies.bicep' = {
   name: '${uniqueString(deployment().name, enforcedLocation)}-test-nestedDependencies-${serviceShort}'
   scope: resourceGroup
   params: {
@@ -60,14 +60,13 @@ module nestedDependencies '../../../../../../../utilities/e2e-template-assets/mo
     virtualNetworkName: 'dep-${namePrefix}-vnet-${serviceShort}'
     networkSecurityGroupName: 'dep-${namePrefix}-nsg-${serviceShort}'
     networkInterfaceName: 'dep-${namePrefix}-mice-${serviceShort}'
-    diskNamePrefix: 'dep-${namePrefix}-disk-${serviceShort}'
     virtualMachineName: 'dep-${namePrefix}-vm-${serviceShort}'
-    waitDeploymentScriptPrefixName: 'dep-${namePrefix}-wds-${serviceShort}'
     arbDeploymentAppId: arbDeploymentAppId
     arbDeploymentServicePrincipalSecret: arbDeploymentServicePrincipalSecret
     arbDeploymentSPObjectId: arbDeploymentSPObjectId
-    deploymentUserPassword: localAdminAndDeploymentUserPass
-    localAdminPassword: localAdminAndDeploymentUserPass
+    deploymentUserPassword: arbLocalAdminAndDeploymentUserPass
+    localAdminPassword: arbLocalAdminAndDeploymentUserPass
+    domainAdminPassword: arbLocalAdminAndDeploymentUserPass
     location: enforcedLocation
   }
 }
@@ -78,9 +77,9 @@ module testDeployment '../../../main.bicep' = {
   params: {
     name: nestedDependencies.outputs.clusterName
     deploymentUser: 'deployUser'
-    deploymentUserPassword: localAdminAndDeploymentUserPass
-    localAdminUser: 'admin-hci'
-    localAdminPassword: localAdminAndDeploymentUserPass
+    deploymentUserPassword: arbLocalAdminAndDeploymentUserPass
+    localAdminUser: 'Administrator'
+    localAdminPassword: arbLocalAdminAndDeploymentUserPass
     servicePrincipalId: arbDeploymentAppId
     servicePrincipalSecret: arbDeploymentServicePrincipalSecret
     hciResourceProviderObjectId: hciResourceProviderObjectId
@@ -88,19 +87,22 @@ module testDeployment '../../../main.bicep' = {
       customLocationName: '${namePrefix}${serviceShort}-location'
       clusterNodeNames: nestedDependencies.outputs.clusterNodeNames
       clusterWitnessStorageAccountName: nestedDependencies.outputs.clusterWitnessStorageAccountName
-      defaultGateway: '172.20.0.1'
+      defaultGateway: '192.168.1.1'
       deploymentPrefix: 'a${take(uniqueString(namePrefix, serviceShort), 7)}' // ensure deployment prefix starts with a letter to match '^(?=.{1,8}$)([a-zA-Z])(\-?[a-zA-Z\d])*$'
-      dnsServers: ['172.20.0.1']
-      domainFqdn: 'hci.local'
+      dnsServers: ['192.168.1.254']
+      domainFqdn: 'jumpstart.local'
       domainOUPath: nestedDependencies.outputs.domainOUPath
-      startingIPAddress: '172.20.0.2'
-      endingIPAddress: '172.20.0.7'
+      startingIPAddress: '192.168.1.55'
+      endingIPAddress: '192.168.1.65'
       enableStorageAutoIp: true
       keyVaultName: nestedDependencies.outputs.keyVaultName
       networkIntents: [
         {
-          adapter: ['mgmt']
-          name: 'management'
+          adapter: [
+            'FABRIC'
+            'FABRIC2'
+          ]
+          name: 'ManagementCompute'
           overrideAdapterProperty: true
           adapterPropertyOverrides: {
             jumboPacket: '9014'
@@ -118,33 +120,17 @@ module testDeployment '../../../main.bicep' = {
             enableIov: 'true'
             loadBalancingAlgorithm: 'Dynamic'
           }
-          trafficType: ['Management']
+          trafficType: [
+            'Management'
+            'Compute'
+          ]
         }
         {
-          adapter: ['comp0', 'comp1']
-          name: 'compute'
-          overrideAdapterProperty: true
-          adapterPropertyOverrides: {
-            jumboPacket: '9014'
-            networkDirect: 'Disabled'
-            networkDirectTechnology: 'iWARP'
-          }
-          overrideQosPolicy: false
-          qosPolicyOverrides: {
-            bandwidthPercentageSMB: '50'
-            priorityValue8021ActionCluster: '7'
-            priorityValue8021ActionSMB: '3'
-          }
-          overrideVirtualSwitchConfiguration: false
-          virtualSwitchConfigurationOverrides: {
-            enableIov: 'true'
-            loadBalancingAlgorithm: 'Dynamic'
-          }
-          trafficType: ['Compute']
-        }
-        {
-          adapter: ['smb0', 'smb1']
-          name: 'storage'
+          adapter: [
+            'StorageA'
+            'StorageB'
+          ]
+          name: 'Storage'
           overrideAdapterProperty: true
           adapterPropertyOverrides: {
             jumboPacket: '9014'
@@ -168,13 +154,13 @@ module testDeployment '../../../main.bicep' = {
       storageConnectivitySwitchless: false
       storageNetworks: [
         {
-          name: 'StorageNetwork0'
-          adapterName: 'smb0'
+          name: 'Storage1Network'
+          adapterName: 'StorageA'
           vlan: '711'
         }
         {
-          name: 'StorageNetwork1'
-          adapterName: 'smb1'
+          name: 'Storage2Network'
+          adapterName: 'StorageB'
           vlan: '712'
         }
       ]
diff --git a/utilities/e2e-template-assets/module-specific/azure-stack-hci/azureStackHCIHost/hciHostDeploymentWithImage.bicep b/utilities/e2e-template-assets/module-specific/azure-stack-hci/azureStackHCIHost/hciHostDeploymentWithImage.bicep
new file mode 100644
index 00000000000..460a94ade8e
--- /dev/null
+++ b/utilities/e2e-template-assets/module-specific/azure-stack-hci/azureStackHCIHost/hciHostDeploymentWithImage.bicep
@@ -0,0 +1,422 @@
+@description('Required. The location for all resource except HCI Arc Nodes and HCI resources')
+param location string
+
+@description('Optional. The Azure VM size for the HCI Host VM, which must support nested virtualization and have sufficient capacity for the HCI node VMs!')
+param hostVMSize string = 'Standard_E32s_v5'
+
+@description('Optional. The local admin user name.')
+param localAdminUsername string = 'admin-hci'
+
+@description('Optional. The domain admin user name.')
+param domainAdminUsername string = 'Administrator'
+
+@description('Optional. The domain admin user password.')
+@secure()
+param domainAdminPassword string
+
+@description('Required. The local admin password.')
+@secure()
+param localAdminPassword string
+
+@secure()
+param arbDeploymentAppId string
+@secure()
+param arbDeploymentServicePrincipalSecret string
+
+@description('Optional. The domain OU path.')
+param domainOUPath string = 'OU=HCI,DC=jumpstart,DC=local'
+
+@description('Optional. The deployment username.')
+param deploymentUsername string = 'deployUser'
+
+@description('Required. The name of the VM-managed user identity to create, used for HCI Arc onboarding.')
+param userAssignedIdentityName string
+
+@description('Required. The name of the VNET for the HCI host Azure VM.')
+param virtualNetworkName string
+
+@description('Required. The name of the NSG to create.')
+param networkSecurityGroupName string
+
+@description('Required. The name of the maintenance configuration for the Azure Stack HCI Host VM and proxy server.')
+param maintenanceConfigurationName string
+
+@description('Required. The name of the Azure VM scale set for the HCI host.')
+param HCIHostVirtualMachineScaleSetName string
+
+@description('Required. The name of the Network Interface Card to create.')
+param networkInterfaceName string
+
+@description('Required. The name of the Azure VM to create.')
+param virtualMachineName string
+
+@description('Required. The name of the Maintenance Configuration Assignment for the proxy server.')
+param maintenanceConfigurationAssignmentName string
+
+// =================================//
+// Deploy Host VM Infrastructure    //
+// =================================//
+
+// vm managed identity used for HCI Arc onboarding
+resource userAssignedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-07-31-preview' = {
+  location: location
+  name: userAssignedIdentityName
+}
+
+// grant identity owner permissions on the resource group
+resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
+  name: guid(subscription().subscriptionId, userAssignedIdentity.name, 'Owner', resourceGroup().id)
+  properties: {
+    principalId: userAssignedIdentity.properties.principalId
+    roleDefinitionId: resourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')
+    principalType: 'ServicePrincipal'
+    description: 'Role assigned used for Azure Stack HCI IaC testing pipeline - remove if identity no longer exists!'
+  }
+}
+
+// grant identity contributor permissions on the subscription - needed to register resource providers
+module roleAssignment_subscriptionContributor 'modules/subscriptionRoleAssignment.bicep' = {
+  name: '${uniqueString(deployment().name, location)}-hcihostmi-roleAssignment_subContributor'
+  scope: subscription()
+  params: {
+    principalId: userAssignedIdentity.properties.principalId
+  }
+}
+
+// optional VNET and subnet for the HCI host Azure VM
+resource vnet 'Microsoft.Network/virtualNetworks@2020-11-01' = {
+  name: virtualNetworkName
+  location: location
+  properties: {
+    addressSpace: {
+      addressPrefixes: ['10.0.0.0/8']
+    }
+    subnets: [
+      {
+        name: 'subnet01'
+        properties: {
+          addressPrefix: '10.0.0.0/8'
+          serviceEndpoints: [
+            {
+              service: 'Microsoft.Storage'
+              locations: [location]
+            }
+            {
+              service: 'Microsoft.KeyVault'
+              locations: [location]
+            }
+          ]
+        }
+      }
+    ]
+  }
+}
+
+// create a mintenance configuration for the Azure Stack HCI Host VM and proxy server
+resource maintenanceConfig 'Microsoft.Maintenance/maintenanceConfigurations@2023-09-01-preview' = {
+  location: location
+  name: maintenanceConfigurationName ?? ''
+  properties: {
+    maintenanceScope: 'InGuestPatch'
+    maintenanceWindow: {
+      recurEvery: 'Week Sunday'
+      startDateTime: '2020-04-30 08:00'
+      duration: '02:00'
+      timeZone: 'UTC'
+    }
+    installPatches: {
+      windowsParameters: {
+        classificationsToInclude: ['Critical', 'Security']
+      }
+      rebootSetting: 'IfRequired'
+    }
+    extensionProperties: {
+      InGuestPatchMode: 'User'
+    }
+  }
+}
+
+resource networkSecurityGroup 'Microsoft.Network/networkSecurityGroups@2020-11-01' = {
+  location: location
+  name: networkSecurityGroupName
+}
+
+resource hciHostVMSSFlex 'Microsoft.Compute/virtualMachineScaleSets@2024-03-01' = {
+  name: HCIHostVirtualMachineScaleSetName
+  location: location
+  zones: ['1', '2', '3']
+  properties: {
+    orchestrationMode: 'Flexible'
+    platformFaultDomainCount: 1
+  }
+}
+
+resource nic 'Microsoft.Network/networkInterfaces@2020-11-01' = {
+  location: location
+  name: networkInterfaceName
+  properties: {
+    networkSecurityGroup: {
+      id: networkSecurityGroup.id
+    }
+    ipConfigurations: [
+      {
+        name: 'ipConfig01'
+        properties: {
+          subnet: {
+            id: vnet.properties.subnets[0].id
+          }
+          privateIPAllocationMethod: 'Dynamic'
+        }
+      }
+    ]
+  }
+}
+
+param imageReferenceId string = '/SharedGalleries/b9e38f20-7c9c-4497-a25d-1a0c5eef2108-DIRECTLYSHARING/Images/vhci-Generalized/Versions/latest'
+
+// Azure Stack HCI Host VM -
+resource vm 'Microsoft.Compute/virtualMachines@2024-03-01' = {
+  location: location
+  name: virtualMachineName
+  zones: ['1']
+  identity: {
+    type: 'UserAssigned'
+    userAssignedIdentities: {
+      '${userAssignedIdentity.id}': {}
+    }
+  }
+  properties: {
+    virtualMachineScaleSet: {
+      id: hciHostVMSSFlex.id
+    }
+    hardwareProfile: {
+      vmSize: hostVMSize
+    }
+    priority: 'Regular'
+    networkProfile: {
+      networkInterfaces: [
+        {
+          id: nic.id
+        }
+      ]
+    }
+    storageProfile: {
+      imageReference: {
+        sharedGalleryImageId: imageReferenceId
+      }
+      osDisk: {
+        createOption: 'FromImage'
+        managedDisk: {
+          storageAccountType: 'Premium_LRS'
+        }
+      }
+    }
+    osProfile: {
+      adminPassword: localAdminPassword
+      adminUsername: localAdminUsername
+      computerName: 'hciHost01'
+      windowsConfiguration: {
+        provisionVMAgent: true
+        enableAutomaticUpdates: true
+        patchSettings: {
+          patchMode: 'AutomaticByPlatform'
+          automaticByPlatformSettings: {
+            bypassPlatformSafetyChecksOnUserSchedule: true
+          }
+        }
+      }
+    }
+    securityProfile: {
+      uefiSettings: {
+        secureBootEnabled: true
+        vTpmEnabled: true
+      }
+      securityType: 'TrustedLaunch'
+    }
+    licenseType: 'Windows_Server'
+  }
+}
+
+resource maintenanceAssignment_hciHost 'Microsoft.Maintenance/configurationAssignments@2023-04-01' = {
+  location: location
+  name: maintenanceConfigurationAssignmentName
+  properties: {
+    maintenanceConfigurationId: maintenanceConfig.id
+  }
+  scope: vm
+}
+
+// ================================================//
+// Initialize Arc on HCI Node VMs and AD for HCI  //
+// ==============================================//
+
+resource ad 'Microsoft.Compute/virtualMachines/runCommands@2024-03-01' = {
+  parent: vm
+  name: 'ad'
+  location: location
+  properties: {
+    source: {
+      script: loadTextContent('./scripts/provision-ad.ps1')
+    }
+    parameters: [
+      {
+        name: 'IP'
+        value: 'hciHost01'
+      }
+      {
+        name: 'Port'
+        value: '6985'
+      }
+      {
+        name: 'Authentication'
+        value: 'Default'
+      }
+      {
+        name: 'DomainFQDN'
+        value: 'jumpstart.local'
+      }
+      {
+        name: 'AdministratorAccount'
+        value: domainAdminUsername
+      }
+      {
+        name: 'ADOUPath'
+        value: domainOUPath
+      }
+      {
+        name: 'DeploymentUserAccount'
+        value: deploymentUsername
+      }
+    ]
+    protectedParameters: [
+      {
+        name: 'AdministratorPassword'
+        value: domainAdminPassword
+      }
+      {
+        name: 'DeploymentUserPassword'
+        value: domainAdminPassword
+      }
+    ]
+  }
+}
+
+resource arc1 'Microsoft.Compute/virtualMachines/runCommands@2024-03-01' = {
+  parent: vm
+  name: 'arc1'
+  location: location
+  properties: {
+    source: {
+      script: loadTextContent('./scripts/provision-arc.ps1')
+    }
+    parameters: [
+      {
+        name: 'IP'
+        value: 'hciHost01'
+      }
+      {
+        name: 'Port'
+        value: '15985'
+      }
+      {
+        name: 'Authentication'
+        value: 'Default'
+      }
+      {
+        name: 'LocalAdministratorAccount'
+        value: domainAdminUsername
+      }
+      {
+        name: 'ServicePrincipalId'
+        value: arbDeploymentAppId
+      }
+      {
+        name: 'SubscriptionId'
+        value: subscription().subscriptionId
+      }
+      {
+        name: 'TenantId'
+        value: subscription().tenantId
+      }
+      {
+        name: 'ResourceGroupName'
+        value: resourceGroup().name
+      }
+      {
+        name: 'Region'
+        value: location
+      }
+    ]
+    protectedParameters: [
+      {
+        name: 'LocalAdministratorPassword'
+        value: domainAdminPassword
+      }
+      {
+        name: 'ServicePrincipalSecret'
+        value: arbDeploymentServicePrincipalSecret
+      }
+    ]
+  }
+}
+
+resource arc2 'Microsoft.Compute/virtualMachines/runCommands@2024-03-01' = {
+  parent: vm
+  name: 'arc2'
+  location: location
+  properties: {
+    source: {
+      script: loadTextContent('./scripts/provision-arc.ps1')
+    }
+    parameters: [
+      {
+        name: 'IP'
+        value: 'hciHost01'
+      }
+      {
+        name: 'Port'
+        value: '25985'
+      }
+      {
+        name: 'Authentication'
+        value: 'Default'
+      }
+      {
+        name: 'LocalAdministratorAccount'
+        value: domainAdminUsername
+      }
+      {
+        name: 'ServicePrincipalId'
+        value: arbDeploymentAppId
+      }
+      {
+        name: 'SubscriptionId'
+        value: subscription().subscriptionId
+      }
+      {
+        name: 'TenantId'
+        value: subscription().tenantId
+      }
+      {
+        name: 'ResourceGroupName'
+        value: resourceGroup().name
+      }
+      {
+        name: 'Region'
+        value: location
+      }
+    ]
+    protectedParameters: [
+      {
+        name: 'LocalAdministratorPassword'
+        value: domainAdminPassword
+      }
+      {
+        name: 'ServicePrincipalSecret'
+        value: arbDeploymentServicePrincipalSecret
+      }
+    ]
+  }
+}
+
+output vnetSubnetResourceId string = vnet.properties.subnets[0].id
diff --git a/utilities/e2e-template-assets/module-specific/azure-stack-hci/azureStackHCIHost/scripts/provision-ad.ps1 b/utilities/e2e-template-assets/module-specific/azure-stack-hci/azureStackHCIHost/scripts/provision-ad.ps1
new file mode 100644
index 00000000000..7a159ff1ed2
--- /dev/null
+++ b/utilities/e2e-template-assets/module-specific/azure-stack-hci/azureStackHCIHost/scripts/provision-ad.ps1
@@ -0,0 +1,51 @@
+﻿# idempotent: TBD
+# TODO: no try, try outside
+
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$IP, # or name
+    [Parameter(Mandatory = $false)]
+    [int]$Port = 5985,
+    [Parameter(Mandatory = $false)]
+    [string]$Authentication = 'Default',
+    [Parameter(Mandatory = $true)]
+    [string]$DomainFQDN,
+    [Parameter(Mandatory = $true)]
+    [string]$AdministratorAccount,
+    [Parameter(Mandatory = $true)]
+    [string]$AdministratorPassword,
+    [Parameter(Mandatory = $true)]
+    [string]$ADOUPath,
+    [Parameter(Mandatory = $true)]
+    [string]$DeploymentUserAccount,
+    [Parameter(Mandatory = $true)]
+    [string]$DeploymentUserPassword
+)
+
+$script:ErrorActionPreference = 'Stop'
+
+Start-Sleep -Seconds 180 # sleep for 3 minutes
+
+try {
+    $username = "$($DomainFQDN.Split('.')[0])\$AdministratorAccount"
+    $securePassword = ConvertTo-SecureString $AdministratorPassword -AsPlainText -Force
+    $credential = New-Object System.Management.Automation.PSCredential -ArgumentList $username, $securePassword
+    $session = New-PSSession -ComputerName $IP -Port $Port -Authentication $Authentication -Credential $credential
+
+    Invoke-Command -Session $session -ScriptBlock {
+        Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Confirm:$false -Verbose
+        Install-Module AsHciADArtifactsPreCreationTool -Repository PSGallery -Force -Confirm:$false -Verbose
+        Add-KdsRootKey -EffectiveTime ((Get-Date).addhours(-10)) -Verbose # TODO: is this idempotent?
+
+        $deploymentSecurePassword = ConvertTo-SecureString $Using:DeploymentUserPassword -AsPlainText -Force
+        $lcmCredential = New-Object System.Management.Automation.PSCredential -ArgumentList $Using:DeploymentUserAccount, $deploymentSecurePassword
+        New-HciAdObjectsPreCreation -AzureStackLCMUserCredential $lcmCredential -AsHciOUName $Using:ADOUPath -Verbose
+        # automatically skipped if it exists
+    }
+} catch {
+    Write-Error $_
+} finally {
+    if ($session) {
+        Remove-PSSession -Session $session
+    }
+}
diff --git a/utilities/e2e-template-assets/module-specific/azure-stack-hci/azureStackHCIHost/scripts/provision-arc.ps1 b/utilities/e2e-template-assets/module-specific/azure-stack-hci/azureStackHCIHost/scripts/provision-arc.ps1
new file mode 100644
index 00000000000..4fdcd1db6fd
--- /dev/null
+++ b/utilities/e2e-template-assets/module-specific/azure-stack-hci/azureStackHCIHost/scripts/provision-arc.ps1
@@ -0,0 +1,138 @@
+﻿# TODO: no try, try outside
+
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$IP, # or name
+    [Parameter(Mandatory = $false)]
+    [int]$Port = 5985,
+    [Parameter(Mandatory = $false)]
+    [string]$Authentication = 'Default',
+    [Parameter(Mandatory = $true)]
+    [string]$LocalAdministratorAccount, # TODO: local admin only
+    [Parameter(Mandatory = $true)]
+    [string]$LocalAdministratorPassword,
+    [Parameter(Mandatory = $true)]
+    [string]$ServicePrincipalId,
+    [Parameter(Mandatory = $true)]
+    [string]$ServicePrincipalSecret,
+    [Parameter(Mandatory = $true)]
+    [string]$SubscriptionId,
+    [Parameter(Mandatory = $true)]
+    [string]$TenantId,
+    [Parameter(Mandatory = $true)]
+    [string]$ResourceGroupName,
+    [Parameter(Mandatory = $true)]
+    [string]$Region
+)
+
+$script:ErrorActionPreference = 'Stop'
+
+try {
+    $username = ".\$LocalAdministratorAccount"
+    $securePassword = ConvertTo-SecureString $LocalAdministratorPassword -AsPlainText -Force
+    $credential = New-Object System.Management.Automation.PSCredential -ArgumentList $username, $securePassword
+    $session = New-PSSession -ComputerName $IP -Port $Port -Authentication $Authentication -Credential $credential
+
+    Invoke-Command -Session $session -ScriptBlock {
+        function Install-ModuleIfMissing {
+            param(
+                [Parameter(Mandatory = $true)]
+                [string]$Name,
+                [Parameter(Mandatory = $false)]
+                [string]$Repository = 'PSGallery',
+                [Parameter(Mandatory = $false)]
+                [switch]$Force,
+                [Parameter(Mandatory = $false)]
+                [switch]$AllowClobber
+            )
+            $module = Get-Module -Name $Name -ListAvailable
+            if (!$module) {
+                Install-Module -Name $Name -Repository $Repository -Force:$Force -AllowClobber:$AllowClobber
+            }
+        }
+
+        Invoke-WebRequest -Uri 'https://aka.ms/AzureConnectedMachineAgent' -OutFile "$env:TEMP\AzureConnectedMachineAgent.msi"
+        msiexec /i "$env:TEMP\AzureConnectedMachineAgent.msi" /l*v "$env:TEMP\AzureConnectedMachineAgentInstall.log" /qn
+
+        Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Confirm:$false
+        Install-ModuleIfMissing -Name Az -Repository PSGallery -Force
+        Install-ModuleIfMissing -Name Az.Accounts -Force -AllowClobber
+        Install-ModuleIfMissing -Name Az.ConnectedMachine -Force -AllowClobber
+        Install-ModuleIfMissing -Name Az.Resources -Force -AllowClobber
+
+        $machineName = [System.Net.Dns]::GetHostName()
+        $correlationID = New-Guid
+        $secureServicePrincipalSecret = ConvertTo-SecureString $Using:ServicePrincipalSecret -AsPlainText -Force
+        $credential = New-Object System.Management.Automation.PSCredential -ArgumentList $Using:ServicePrincipalId, $secureServicePrincipalSecret
+        Connect-AzAccount -ServicePrincipal -Credential $credential -Subscription $Using:SubscriptionId -Tenant $Using:TenantId
+        $token = (Get-AzAccessToken).Token
+        # TODO: PowerShell 7
+        # $token = ConvertFrom-SecureString -SecureString ((Get-AzAccessToken -AsSecureString).Token) -AsPlainText
+
+        $azcmagentPath = "$env:ProgramW6432\AzureConnectedMachineAgent\azcmagent.exe"
+        & "$azcmagentPath" --version
+        & "$azcmagentPath" connect --resource-group "$Using:ResourceGroupName" --resource-name "$machineName" --tenant-id "$Using:TenantId" --location "$Using:Region" --subscription-id "$Using:SubscriptionId" --cloud 'AzureCloud' --correlation-id "$correlationID" --access-token "$token";
+        if ($LASTEXITCODE -ne 0) {
+            throw 'Arc server connection failed'
+        }
+
+        # TODO: work around
+        Get-NetAdapter StorageA | Disable-NetAdapter -Confirm:$false
+        Get-NetAdapter StorageB | Disable-NetAdapter -Confirm:$false
+
+        Write-Output 'PUT edge device resource to install mandatory extensions'
+        $uri = "https://management.azure.com/subscriptions/$Using:SubscriptionId/resourceGroups/$Using:ResourceGroupName/providers/Microsoft.HybridCompute/machines/$machineName/providers/Microsoft.AzureStackHCI/edgeDevices/default?api-version=2024-04-01"
+        $body = @{
+            'kind'       = 'HCI';
+            'properties' = @{};
+        }
+        $headers = @{
+            'Authorization' = "Bearer $token";
+        }
+        Invoke-RestMethod -Uri $uri -Method Put -Headers $headers -Body ($body | ConvertTo-Json) -ContentType 'application/json'
+
+        Write-Output 'Waiting for Edge device resource to be ready'
+        Start-Sleep -Seconds 600
+        $waitInterval = 60
+        $maxWaitCount = 30
+        $ready = $false
+        for ($waitCount = 0; $job.JobState -ne 'Transferred' -and $waitCount -lt $maxWaitCount; $waitCount++) {
+            Connect-AzAccount -ServicePrincipal -Credential $credential -Subscription $Using:SubscriptionId -Tenant $Using:TenantId | Out-Null
+            $token = (Get-AzAccessToken).Token
+            # TODO: PowerShell 7
+            # $token = ConvertFrom-SecureString -SecureString ((Get-AzAccessToken -AsSecureString).Token) -AsPlainText
+            $headers = @{
+                'Authorization' = "Bearer $token";
+            }
+            try {
+                $response = Invoke-RestMethod -Uri $uri -Method Get -Headers $headers
+                if ($response.properties.provisioningState -eq 'Succeeded') {
+                    $ready = $true
+                    break
+                }
+            } catch {
+                Write-Output "Failed to get Edge device resource: $_"
+            } finally {
+                Write-Output 'Waiting for Edge device resource to be ready'
+                Start-Sleep -Seconds $waitInterval
+            }
+        }
+
+        # TODO: work around
+        Get-NetAdapter StorageA | Enable-NetAdapter -Confirm:$false
+        Get-NetAdapter StorageB | Enable-NetAdapter -Confirm:$false
+
+        if (!$ready) {
+            # TODO: is this part still retryable? unless arc can be connected multiple times
+            throw 'Edge device resource is not ready after 30 minutes.'
+        }
+    }
+
+    Write-Output 'Arc server connected and all mandatory extensions are ready!'
+} catch {
+    Write-Error $_
+} finally {
+    if ($session) {
+        Remove-PSSession -Session $session
+    }
+}
diff --git a/utilities/e2e-template-assets/module-specific/azure-stack-hci/dependencies/defaults-dependencies.bicep b/utilities/e2e-template-assets/module-specific/azure-stack-hci/dependencies/defaults-dependencies.bicep
index bafe3aa11da..82596355400 100644
--- a/utilities/e2e-template-assets/module-specific/azure-stack-hci/dependencies/defaults-dependencies.bicep
+++ b/utilities/e2e-template-assets/module-specific/azure-stack-hci/dependencies/defaults-dependencies.bicep
@@ -30,10 +30,6 @@ param keyVaultDiagnosticStorageAccountName string
 @description('Required. The name of the Key Vault to create.')
 param keyVaultName string
 
-@description('Required. The service principal ID of the Azure Stack HCI Resource Provider in this tenant.')
-@secure()
-param hciResourceProviderObjectId string
-
 @description('Required. The name of the Azure Stack HCI cluster.')
 param clusterName string
 
diff --git a/utilities/e2e-template-assets/module-specific/azure-stack-hci/dependencies/dependencies.bicep b/utilities/e2e-template-assets/module-specific/azure-stack-hci/dependencies/dependencies.bicep
new file mode 100644
index 00000000000..8e91463d5c8
--- /dev/null
+++ b/utilities/e2e-template-assets/module-specific/azure-stack-hci/dependencies/dependencies.bicep
@@ -0,0 +1,111 @@
+@description('Optional. The password of the LCM deployment user and local administrator accounts.')
+@secure()
+param deploymentUserPassword string
+@description('Required. The password of the LCM deployment user and local administrator accounts.')
+@secure()
+param localAdminPassword string
+@secure()
+param domainAdminPassword string
+
+@description('Required. The app ID of the service principal used for the Azure Stack HCI Resource Bridge deployment. If omitted, the deploying user must have permissions to create service principals and role assignments in Entra ID.')
+@secure()
+param arbDeploymentAppId string
+@description('Required. The service principal ID of the service principal used for the Azure Stack HCI Resource Bridge deployment. If omitted, the deploying user must have permissions to create service principals and role assignments in Entra ID.')
+@secure()
+param arbDeploymentSPObjectId string
+@description('Required. The secret of the service principal used for the Azure Stack HCI Resource Bridge deployment. If omitted, the deploying user must have permissions to create service principals and role assignments in Entra ID.')
+@secure()
+param arbDeploymentServicePrincipalSecret string
+@description('Required. The location to deploy the resources into.')
+param location string
+@description('Required. The name of the storage account to create as a cluster witness.')
+param clusterWitnessStorageAccountName string
+@description('Required. The name of the storage account to be created to collect Key Vault diagnostic logs.')
+param keyVaultDiagnosticStorageAccountName string
+@description('Required. The name of the Key Vault to create.')
+param keyVaultName string
+
+@description('Required. The name of the Azure Stack HCI cluster.')
+param clusterName string
+
+@description('Required. The name of the VM-managed user identity to create, used for HCI Arc onboarding.')
+param userAssignedIdentityName string
+@description('Required. The name of the maintenance configuration for the Azure Stack HCI Host VM and proxy server.')
+param maintenanceConfigurationName string
+@description('Required. The name of the Azure VM scale set for the HCI host.')
+param HCIHostVirtualMachineScaleSetName string
+@description('Conditional. The name of the Network Security Group ro create.')
+param networkSecurityGroupName string
+@description('Required. The name of the virtual network to create. Used to connect the HCI Azure Host VM to an existing VNET in the same region.')
+param virtualNetworkName string
+@description('Required. The name of the Network Interface Card to create.')
+param networkInterfaceName string
+
+@description('Required. The name of the Azure VM to create.')
+param virtualMachineName string
+
+@description('Required. The name of the Maintenance Configuration Assignment for the proxy server.')
+param maintenanceConfigurationAssignmentName string
+
+var clusterNodeNames = ['AzSHOST1', 'AzSHOST2']
+var domainOUPath = 'OU=HCI,DC=jumpstart,DC=local'
+module hciHostDeployment '../azureStackHCIHost/hciHostDeploymentWithImage.bicep' = {
+  name: '${uniqueString(deployment().name, location)}-test-hcihostdeploy'
+  params: {
+    domainOUPath: domainOUPath
+    arbDeploymentAppId: arbDeploymentAppId
+    arbDeploymentServicePrincipalSecret: arbDeploymentServicePrincipalSecret
+    hostVMSize: 'Standard_E32s_v5'
+    localAdminPassword: localAdminPassword
+    domainAdminPassword: domainAdminPassword
+    location: location
+    HCIHostVirtualMachineScaleSetName: HCIHostVirtualMachineScaleSetName
+    maintenanceConfigurationAssignmentName: maintenanceConfigurationAssignmentName
+    maintenanceConfigurationName: maintenanceConfigurationName
+    networkInterfaceName: networkInterfaceName
+    networkSecurityGroupName: networkSecurityGroupName
+    virtualNetworkName: virtualNetworkName
+    userAssignedIdentityName: userAssignedIdentityName
+    virtualMachineName: virtualMachineName
+  }
+}
+
+// create the HCI cluster resource - cloudId property is needed for KeyVault secret names
+resource cluster 'Microsoft.AzureStackHCI/clusters@2024-04-01' = {
+  name: clusterName
+  identity: {
+    type: 'SystemAssigned'
+  }
+  location: location
+  properties: {}
+}
+module hciClusterPreqs '../azureStackHCIClusterPreqs/ashciPrereqs.bicep' = {
+  name: '${uniqueString(deployment().name, location)}-test-hciclusterreqs'
+  params: {
+    location: location
+    arbDeploymentAppId: arbDeploymentAppId
+    arbDeploymentServicePrincipalSecret: arbDeploymentServicePrincipalSecret
+    arbDeploymentSPObjectId: arbDeploymentSPObjectId
+    clusterWitnessStorageAccountName: clusterWitnessStorageAccountName
+    keyVaultDiagnosticStorageAccountName: keyVaultDiagnosticStorageAccountName
+    deploymentUsername: 'deployUser'
+    deploymentUserPassword: deploymentUserPassword
+    keyVaultName: keyVaultName
+    localAdminPassword: localAdminPassword
+    localAdminUsername: 'Administrator'
+    logsRetentionInDays: 30
+    softDeleteRetentionDays: 30
+    tenantId: subscription().tenantId
+    vnetSubnetResourceId: hciHostDeployment.outputs.vnetSubnetResourceId
+  }
+}
+@description('The name of the created cluster')
+output clusterName string = cluster.name
+@description('The name of the cluster\'s nodes.')
+output clusterNodeNames array = clusterNodeNames
+@description('The name of the storage account used as the cluster witness.')
+output clusterWitnessStorageAccountName string = clusterWitnessStorageAccountName
+@description('The OU path for the domain.')
+output domainOUPath string = domainOUPath
+@description('The name of the created Key Vault.')
+output keyVaultName string = keyVaultName


Reviews:
user: login: DanteMustCode
state: DISMISSED
author_association: CONTRIBUTOR
submitted_at: 2025-05-12T12:16:52Z
user: login: AlexanderSehr
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-12T12:49:05Z
user: login: AlexanderSehr
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-12T12:49:37Z
user: login: AlexanderSehr
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-12T12:51:01Z
user: login: xhy8759
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-12T12:56:24Z
user: login: nasusoba
state: DISMISSED
author_association: NONE
submitted_at: 2025-05-13T02:10:39Z
user: login: DanteMustCode
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-13T06:42:33Z
user: login: AlexanderSehr
state: APPROVED
author_association: COLLABORATOR
submitted_at: 2025-05-13T06:43:26Z

Review comments:
diff_hunk: @@ -0,0 +1,51 @@
+﻿# idempotent: TBD
+# TODO: no try, try outside
+
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$IP, # or name
+    [Parameter(Mandatory = $false)]
+    [int]$Port = 5985,
+    [Parameter(Mandatory = $false)]
+    [string]$Authentication = 'Default',
+    [Parameter(Mandatory = $true)]
+    [string]$DomainFQDN,
+    [Parameter(Mandatory = $true)]
+    [string]$AdministratorAccount,
+    [Parameter(Mandatory = $true)]
+    [string]$AdministratorPassword,
+    [Parameter(Mandatory = $true)]
+    [string]$ADOUPath,
+    [Parameter(Mandatory = $true)]
+    [string]$deploymentUserAccount,
+    [Parameter(Mandatory = $true)]
+    [string]$deploymentUserPassword
path: utilities/e2e-template-assets/module-specific/azure-stack-hci/azureStackHCIHost/scripts/provision-ad.ps1
user: login: AlexanderSehr
body: Passwords should use `secureString`. Any chance you could use that?
created_at: 2025-05-12T12:49:05Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,138 @@
+﻿# TODO: no try, try outside
+
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$IP, # or name
+    [Parameter(Mandatory = $false)]
+    [int]$Port = 5985,
+    [Parameter(Mandatory = $false)]
+    [string]$Authentication = 'Default',
+    [Parameter(Mandatory = $true)]
+    [string]$LocalAdministratorAccount, # TODO: local admin only
+    [Parameter(Mandatory = $true)]
+    [string]$LocalAdministratorPassword,
+    [Parameter(Mandatory = $true)]
+    [string]$ServicePrincipalId,
+    [Parameter(Mandatory = $true)]
+    [string]$ServicePrincipalSecret,
path: utilities/e2e-template-assets/module-specific/azure-stack-hci/azureStackHCIHost/scripts/provision-arc.ps1
user: login: AlexanderSehr
body: Same comment as for the other script. Secrets that are not defined as 'secure' may be exposed.
created_at: 2025-05-12T12:49:36Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,51 @@
+﻿# idempotent: TBD
+# TODO: no try, try outside
+
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$IP, # or name
+    [Parameter(Mandatory = $false)]
+    [int]$Port = 5985,
+    [Parameter(Mandatory = $false)]
+    [string]$Authentication = 'Default',
+    [Parameter(Mandatory = $true)]
+    [string]$DomainFQDN,
+    [Parameter(Mandatory = $true)]
+    [string]$AdministratorAccount,
+    [Parameter(Mandatory = $true)]
+    [string]$AdministratorPassword,
+    [Parameter(Mandatory = $true)]
+    [string]$ADOUPath,
+    [Parameter(Mandatory = $true)]
+    [string]$deploymentUserAccount,
+    [Parameter(Mandatory = $true)]
+    [string]$deploymentUserPassword
path: utilities/e2e-template-assets/module-specific/azure-stack-hci/azureStackHCIHost/scripts/provision-ad.ps1
user: login: AlexanderSehr
body: I guess it's plain because it is coming straight from the KeyVault?
created_at: 2025-05-12T12:51:01Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,51 @@
+﻿# idempotent: TBD
+# TODO: no try, try outside
+
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$IP, # or name
+    [Parameter(Mandatory = $false)]
+    [int]$Port = 5985,
+    [Parameter(Mandatory = $false)]
+    [string]$Authentication = 'Default',
+    [Parameter(Mandatory = $true)]
+    [string]$DomainFQDN,
+    [Parameter(Mandatory = $true)]
+    [string]$AdministratorAccount,
+    [Parameter(Mandatory = $true)]
+    [string]$AdministratorPassword,
+    [Parameter(Mandatory = $true)]
+    [string]$ADOUPath,
+    [Parameter(Mandatory = $true)]
+    [string]$deploymentUserAccount,
+    [Parameter(Mandatory = $true)]
+    [string]$deploymentUserPassword
path: utilities/e2e-template-assets/module-specific/azure-stack-hci/azureStackHCIHost/scripts/provision-ad.ps1
user: login: xhy8759
body: yes, it's plain because it's coming straight from the KeyVault.
created_at: 2025-05-12T12:56:24Z
author_association: CONTRIBUTOR

PR comments:
user: login: microsoft-github-policy-service[bot]
created_at: 2025-05-12T04:45:34Z
body: > [!IMPORTANT]
> **The "Needs: Triage :mag:" label must be removed once the triage process is complete!**

> [!TIP]
> For additional guidance on how to triage this issue/PR, see the [BRM Issue Triage](https://azure.github.io/Azure-Verified-Modules/help-support/issue-triage/brm-issue-triage/) documentation.

<!-- Policy app identification https://img.shields.io/static/v1?label=PullRequestIssueManagement. -->
author_association: NONE
user: login: microsoft-github-policy-service[bot]
created_at: 2025-05-12T04:45:35Z
body: > [!IMPORTANT]
> If this is a module-related PR, being submitted by the sole owner of the module, the AVM core team must review and approve it (as module owners can't approve their own PRs).
>
> **To indicate this PR needs the core team''s attention, apply the "Needs: Core Team 🧞" label!**
>
> The core team will only review and approve PRs that have this label applied!

<!-- Policy app identification https://img.shields.io/static/v1?label=PullRequestIssueManagement. -->
author_association: NONE