Explanation
Graphical user interface, text, application, email Description automatically generated

Step 1: Create a JSON file that contains the role definition.
Rather than using an account that has Owner permissions in the Azure subscription, you can create a custom role to assign permissions to a less-privileged user account. This account can then be used to register your Azure Stack Hub.
Create a custom role using PowerShell
Use the following JSON template to simplify creation of the custom role. The template creates a custom role that allows the required read and write access for Azure Stack Hub registration.
1. Create a JSON file. For example, C:\CustomRoles\registrationrole.json.
2. Add the following JSON to the file. Replace <SubscriptionID> with your Azure subscription ID.
{
"Name": "Azure Stack Hub registration role",
"Id": null,
"IsCustom": true,
"Description": "Allows access to register Azure Stack Hub",
"Actions": [
"Microsoft.Resources/subscriptions/resourceGroups/write",
"Microsoft.Resources/subscriptions/resourceGroups/read",
"Microsoft.AzureStack/registrations/*",
"Microsoft.AzureStack/register/action",
"Microsoft.Authorization/roleAssignments/read",
"Microsoft.Authorization/roleAssignments/write",
"Microsoft.Authorization/roleAssignments/delete",
"Microsoft.Authorization/permissions/read",
"Microsoft.Authorization/locks/read",
"Microsoft.Authorization/locks/write"
],
"NotActions": [
],
"AssignableScopes": [
"/subscriptions/<SubscriptionID>"
]
}
3. In PowerShell, connect to Azure to use Azure Resource Manager. When prompted, authenticate using an account with sufficient permissions such as Owner or User Access Administrator.
Connect-AzAccount
4. To create the custom role, use New-AzRoleDefinition specifying the JSON template file.
New-AzRoleDefinition -InputFile "C:\CustomRoles\registrationrole.json"
Step 2: From Azure Cloud shell, run the New-AzRoleDefinition cmdlet.
Step 3: From the Azure portal, add a role assignment to sub1.
Assign a user to registration role
After the registration custom role is created, assign the role to the user account that will be used for registering Azure Stack Hub.
* Sign in with the account with sufficient permission on the Azure subscription to delegate rights - such as Owner or User Access Administrator.
* In Subscriptions, select Access control (IAM) > Add role assignment.
* In Role, choose the custom role you created: Azure Stack Hub registration role.
* Select the users you want to assign to the role.
* Select Save to assign the selected users to the role.

Reference: https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-registration-role

Explanation
Step 1: user subscriptions
If you want to delete a quota, you must work back through any plans and offers that use that quota. Starting with the offers, ensure they have no subscriptions, delete each offer, then delete the plans that use the quota, and so on.
Step 2: offers
Deleting an offer is only possible if there are no subscriptions that belong to that offer.
Step 3: plans
You can't delete a quota if there are any current plans that use it. You must first delete the plan that references the quota.
Reference:
https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-delete-offer

Explanation
Box 1: 30 days
We cannot tell for sure without the exhibit. It would likely be either 30 or 90 days.
The Azure Stack Hub root certificate is provisioned during deployment with an expiration of five years.
Starting with 2108, internal secret rotation also rotates the root certificate. The standard secret expiration alert identifies the expiry of the root certificate and generates alerts at both 90 (warning) and 30 (critical) days.
Note: Manual remediation
If the Repair option is not supported, be sure to follow the complete set of remediation instructions provided in the alert. As an example, the internal certificate expiration remediation steps will guide you through the process of secret rotation:
Graphical user interface, text, application Description automatically generated

Box 2: running the Start-SecreatRotation -Internal PowerShell cmdlet from the priveged endpoint (PEP) session Start-SecretRotation cmdlet rotates the infrastructure secrets of an Azure Stack Hub system. This cmdlet can only be executed against the Azure Stack Hub privileged endpoint, by using an Invoke-Command script block passing the PEP session in the -Session parameter. By default, it rotates only the certificates of all external network infrastructure endpoints.
Reference:
https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-rotate-secrets
https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-monitor-health

Explanation

Box 1: Connect-AzAccount
Steps to validate the Azure registration
1. Open an elevated PowerShell prompt, and then run the following command to install AzsReadinessChecker:
Install-Module -Name Az.BootStrapper -Force -AllowPrerelease
Install-AzProfile -Profile 2020-09-01-hybrid -Force
Install-Module -Name Microsoft.AzureStack.ReadinessChecker
2. From the PowerShell prompt, run the following command to set $subscriptionID as the Azure subscription to use. Replace xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx with your own subscription ID:
$subscriptionID = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
3. From the PowerShell prompt, run the following command:
Connect-AzAccount -subscription $subscriptionID
4. From the PowerShell prompt, run the following command to start validation of your subscription. Provide your Azure AD administrator and your Azure AD tenant name:
Invoke-AzsRegistrationValidation -RegistrationSubscriptionID $subscriptionID Box 2: Microsoft.AzureStack.ReadinessChecker Validate AD FS integration
1. On a computer that meets the prerequisites, open an administrative PowerShell prompt and then run the following command to install AzsReadinessChecker:
Install-Module Microsoft.AzureStack.ReadinessChecker -Force -AllowPrerelease
2. From the PowerShell prompt, run the following command to start validation. Specify the value for
-CustomADFSFederationMetadataEndpointUri as the URI for the federation metadata.
Invoke-AzsADFSValidation -CustomADFSFederationMetadataEndpointUri https://adfs.cont Reference:
https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-validate-registration
https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-validate-adfs