How to enable MSI (Managed Service Identity) for Batch compute nodes in User Subscription Mode

[v-mosh21]

Background:

Currently we can enable Azure Managed Identity to use platform-managed keys or customer-managed keys to encrypt the customer data which is stored in Azure Batch: https://docs.microsoft.com/en-us/azure/batch/batch-customer-managed-key. However, the managed identity on the Batch account is not available on the compute nodes. There was an active feature request submitted to Azure Batch team and Azure Active Directory team asking for supporting MSI in Azure Batch environment: https://feedback.azure.com/forums/269742-batch/suggestions/33640984-support-managed-service-identity.... The implementation of this feature has begun but there is no ETA at this time. As an optional plan,  we could enable MSI for compute nodes in user subscription mode which means that user would need to manage his own Virtual Machine Scale Sets (VMSS) and those nodes are in MSI enabled environment.

Purpose:

In user subscription mode, customer can enable MSI for compute nodes directly by their own. Please note the following limitations:

1. Right now this optional plan is only valid when the pool allocation mode is user subscription which means all the compute nodes are going to be provisioned in your subscription. Please check this document for the details: https://docs.microsoft.com/en-us/azure/batch/batch-account-create-portal#create-a-batch-account
2. When these Batch VMs are provisioned every time,  for example, Batch Service creates a new Virtual Machine Scale Sets due to some scale out activity, you are required to enable the MSI manually. You can do it via Portal, PowerShell or REST API .

Pre-requirement:

• Prepare an Azure Batch account with User Subscription mode

Steps:

1. Create a new pool in the Batch account, the VMSS will be added to your subscription in a different resource group.

2. Access to the resource group and select VMSS.

3. Access to the VMSS and select the Identity tab to enable the MSI. This document provides more information about enabling system-assigned managed identify and user-assigned managed identity: https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/qs-config....

4. You will be able to modify the role assignments. In my example, I assigned Owner role of subscription in the Azure role assignments.

5. RDP to the VMSS to test if the MSI works or not. Now I can get the token to list the information of my resource group. This document lists the PowerShell command that I used in this example: https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-....

$response = Invoke-WebRequest -Uri 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://manage...' -Method GET -Headers @{Metadata=”true”}

$content = $response.Content | ConvertFrom-Json

$ArmToken = $content.access_token

(Invoke-WebRequest -Uri 'https://management.azure.com/subscriptions/a2d49d28-b5b1-48fe-83dc-ada50a035a99/resourceGroups/moshi...' -Method GET -ContentType "application/json" -Headers @{ Authorization="Bearer $ArmToken"}).content