When deploying Azure Virtual Machine Scale Sets (VMSS) using an Azure Resource Manager (ARM) template, you can automatically install and configure applications or services (like NGINX) on the virtual machines using the Azure Custom Script Extension.
According to the Microsoft Azure Administrator documentation, the Custom Script Extension is used to download and execute scripts on Azure virtual machines after deployment. It is ideal for configuration management, application installation, and post-deployment software setup.
The extension can execute PowerShell or Bash scripts stored in Azure Storage or GitHub repositories. When used with an ARM template, you define the extension in the template's " resources " section under " type " : " Microsoft.Compute/virtualMachines/extensions " or " Microsoft.Compute/virtualMachineScaleSets
/extensions " .
Microsoft's official documentation notes:
"The Custom Script Extension for Windows and Linux downloads and executes scripts on Azure virtual machines. This extension is useful for post-deployment configuration, software installation, or any other configuration or management tasks." In this case, using Azure Custom Script Extension allows automatic installation of NGINX on all VM instances as soon as they are created in the scale set - satisfying the requirement that NGINX is available immediately after deployment.
Other options do not fit:
* Application Insights is used for monitoring, not configuration.
* Publish-AzVMDscConfiguration and New-AzConfigurationAssignment are used for Desired State Configuration (DSC), not lightweight application installation like NGINX.
Hence, the only verified and cost-efficient solution is Azure Custom Script Extension.

Azure Container Registry (ACR) uses Azure roles-based access control (RBAC) to determine who can pull, push, or manage images. The AcrPull role allows identities to pull (read) container images from a registry but not to push (write) or deploy images.
In this scenario, the error occurs when trying to deploy an Azure Container Instance (ACI) using an image from Registry1. The deployment process requires that the Azure Container Instance resource provider (the identity performing the deployment) has access permissions to pull the image from ACR. However, simply assigning the AcrPull role to an internal system identity like ACR-Tasks-Network does not necessarily authorize the ACI to pull images unless that specific managed identity used by ACI has the role assignment.
According to the Microsoft Azure Administrator documentation, the correct method to allow a container instance to pull an image from an Azure Container Registry is:
Enable a managed identity (system-assigned or user-assigned) for the Azure Container Instance.
Assign that managed identity the AcrPull role on the container registry.
The ACR Tasks Network identity mentioned in the scenario is used internally by ACR for automated build tasks, not for deployment of container instances. Therefore, assigning the AcrPull role to ACR-Tasks- Network does not resolve the issue of ACI being unable to access the container image.
Hence, this solution does not meet the goal because the role was assigned to the wrong identity. The correct approach is to assign AcrPull to the Azure Container Instance's managed identity instead.

Explanation:

Explanation:
They are all Global admins so they can all modify user permission. i.e add self as owner etc.
You can be GA in one of the subscription, it doesn ' t mean that you can create the resources in all subscription. As a Global Administrator in Azure Active Directory (Azure AD), you might not have access to all subscriptions and management groups in your directory. Azure AD and Azure resources are secured independently from one another. That is, Azure AD role assignments do not grant access to Azure resources, and Azure role assignments do not grant access to Azure AD.
However, if you are a Global Administrator in Azure AD, you can assign yourself access to all Azure subscriptions and management groups in your directory Reference:
https://docs.microsoft.com/en-gb/azure/role-based-access-control/elevate-access-global-admin

To create a load balancing rule that will load balance HTTPS traffic between VM1 and VM2, you need to create two additional load balance resources: a frontend IP address and a health probe.
A frontend IP address is the IP address that the clients use to access the load balancer. It can be either public or private, depending on the type of load balancer. A frontend IP address is required for any load balancing rule1.
A health probe is used to monitor the health and availability of the backend instances. It can be either TCP, HTTP, or HTTPS, depending on the protocol of the load balancing rule. A health probe is required for any load balancing rule1.
A backend pool is a group of backend instances that receive the traffic from the load balancer. You already have a backend pool that contains VM1 and VM2, so you don't need to create another one.
An inbound NAT rule is used to forward traffic from a specific port on the frontend IP address to a specific port on a backend instance. It's not required for a load balancing rule, but it can be used to access individual instances for troubleshooting or maintenance purposes1.
A virtual network is a logical isolation of Azure resources within a region. It's not a load balance resource, but it's required for creating an internal load balancer or connecting virtual machines to a load balancer2.

When deploying a virtual machine via an ARM template, dependencies must ensure resources are created in the proper order. A VM requires a network interface (NIC) at creation time; therefore, the VM resource must depend on the NIC.
The NIC itself depends on the virtual network, subnet, network security group, and public IP (if applicable).
Microsoft ARM template guidance specifies that the VM's dependsOn should reference the NIC, allowing Azure Resource Manager to implicitly handle the remaining network dependencies.