Review the Setup Scripts Before You Run Them

What the two Atlas AVD setup scripts (full access and read-only) create in your Microsoft Entra directory, how to open Azure Cloud Shell, and more.

Before you begin

  • A Microsoft Entra account that is a Global Administrator
  • Owner (or User Access Administrator) on the Azure subscription Atlas will manage
  • Azure Cloud Shell in Bash mode

Open Azure Cloud Shell

Use the Open Azure Cloud Shell button on your setup page, or go to shell.azure.com (Azure Commercial and GCC) or shell.azure.us (GCC High and Azure Government). Sign in as a Global Administrator of the directory you are setting up and choose Bash.

Cloud Shell already has everything the scripts need: the Azure CLI, curl, sha256sum and OpenSSL 3. Nothing is installed on your own computer.

Full access: setup.sh

Creates the Atlas AVD app registration with everything Atlas needs: the same permissions the automatic setup would request. Choose it to evaluate every feature.

It adds Microsoft Graph, Microsoft Defender for Endpoint and Exchange Online application permissions, grants admin consent, assigns the Exchange Administrator and Compliance Administrator directory roles to the app, assigns Azure roles at subscription scope, and creates a client secret. The full list, with the reason for each permission, is in App Permissions Troubleshooting. Current version: 1.26.0.

  • Read the script: https://controlplane.atlasavd.us/downloads/v/1.26.0/setup.sh
  • SHA-256: 582d1be2b2bca95bdfd71323ec1f49a816815e1dbca2da27d478a3f4de0b3f2f
curl -fsSL -o setup.sh https://controlplane.atlasavd.us/downloads/v/1.26.0/setup.sh && echo "582d1be2b2bca95bdfd71323ec1f49a816815e1dbca2da27d478a3f4de0b3f2f  setup.sh" | sha256sum -c && bash setup.sh

Read-only for evaluation: setup-readonly.sh

Creates the same app registration with only read permissions and reader roles. Atlas can show your environment but cannot change it, and actions that make changes stay unavailable.

When you are ready for full access, run setup.sh. It upgrades the same registration in place, so you keep your Client ID. Current version: 1.5.1.

  • Read the script: https://controlplane.atlasavd.us/downloads/v/1.5.1/setup-readonly.sh
  • SHA-256: b32cd39c2439d16a2b6584b0cca58fb755c002b304a2f541308ab282604b4b41
curl -fsSL -o setup-readonly.sh https://controlplane.atlasavd.us/downloads/v/1.5.1/setup-readonly.sh && echo "b32cd39c2439d16a2b6584b0cca58fb755c002b304a2f541308ab282604b4b41  setup-readonly.sh" | sha256sum -c && bash setup-readonly.sh

How the command checks the script

  1. curl downloads one exact, version-pinned copy of the script. A version link never changes; when a script is updated it gets a new version number.
  2. sha256sum -c compares the download with the SHA-256 printed on your setup page. If a single byte differs, the command stops here.
  3. Only then does bash run the script. Nothing is piped straight from the internet into a shell, so you can open the downloaded file and read it first.

Want to read before running? Run only the first part of the command (up to sha256sum -c), open the file with code setup.sh or less setup.sh, and run bash setup.sh when you are satisfied.

Set up and deploy with one command

The command on your setup page starts with ATLAS_TEMPLATE_URL set to your own deploy template. With it, the script creates the app registration and then deploys Atlas into the subscription Cloud Shell is signed in to, so there is no Azure Portal wizard to fill in. Without it, the script only creates the registration.

First the script sets up the registration as usual. It ends that part with a Setup complete summary (the registration's IDs, its app roles, permissions, directory roles and Azure roles) and prints the Client ID and Client Secret under COPY THESE VALUES. You do not need to paste them anywhere: the deploy step that follows uses them directly. The script then shows Deploy Atlas AVD to subscription and the subscription ID, and asks three questions. Press Enter to accept the suggested answer in brackets.

  • Resource group: a new or existing resource group for Atlas.
  • Region: the script lists the regions where Azure offers your subscription what Atlas needs, numbered. Type the number or the region name. If you type something that is not on the list, it asks again. Azure checks your quota when the deployment runs.
  • First Atlas administrator: the person who signs in to Atlas first, suggested as you. If you are a guest in this directory, it suggests your usual email address.

Running it unattended? Set ATLAS_RESOURCE_GROUP, ATLAS_LOCATION and ATLAS_ADMIN_UPN before the command and the script uses them instead of asking. A region that is not on the list stops the script before anything is created.

While it deploys

Deploying usually takes 10 to 20 minutes. Keep Cloud Shell open. The script shows each part of Atlas as Azure creates it, with a tick and the time it took, for example ✓ Key Vault (0:42) and ✓ PostgreSQL server (6:10). If nothing changes for a minute, it says what it is still waiting on.

When it finishes, the script registers Atlas's sign-in address and prints Open Atlas AVD: followed by your Atlas address. Open it and sign in as the administrator you chose. The first start takes a few minutes while Atlas prepares its database.

If a part fails, the script names it and shows Azure's own error for it, then stops. The app registration it created stays ready. Fix the cause (for example, pick another region) and run the same command again; it reuses the registration. The deployment also shows in the Azure portal under your resource group's Deployments.

Prefer the Azure Portal wizard?

Run the script without the deploy step (the plain command above) and it prints a Client ID and a Client Secret. Copy both now: the secret is not shown again. Back on your setup page, deploy with the Azure Portal wizard and paste them into its App Registration step.

Running a script twice is safe. It finds the existing registration and updates it instead of creating a second one.

Next steps