Prerequisites for Azure Marketplace

Last published : Oct 22, 2026
Everything on this page must be true before you select Create in the Azure portal. The deployment does not tell you that you skipped an item. Some items fail only after the AKS cluster exists and is billing.
Related information
Deploy from Azure Marketplace

Checklist

You need Details
1 An Azure subscription where you hold at least the Contributor role, or Owner for a certificate obtained for you Azure subscription and roles
2 The resource providers Microsoft.ContainerInstance and Microsoft.Storage registered Register two resource providers
3 A hostname that is a subdomain of a DNS zone you control Hostname and DNS
4 Permission to create records in that zone after the deployment Hostname and DNS
5 On the Contributor path, a TLS certificate for two names TLS certificate
6 A subscription that permits privileged workloads and AKS local accounts Policy constraints
7 Outbound access to the listed destinations, one of them permanently Outbound network destinations
8 Acceptance of the Community Edition limits and the daily usage upload Community Edition
9 A TOTP authenticator app for the first administrator sign-in After the deployment
10 Acceptance that the installation receives no upgrades and no backups What is not included

What the offer creates

The offer creates an AKS cluster in your subscription and installs Citrix SecurSpaces™ from a public container registry. Every resource it creates is in the managed resource group, on your bill and under your control. Citrix keeps no standing access to the cluster.
On the Owner path, the deployment also creates an Azure DNS zone named after your hostname, a user-assigned identity for the certificate manager, and one role assignment: DNS Zone Contributor on that zone only. On the Contributor path, it creates no identity and no role assignment.

Azure subscription and roles

Path Role needed at subscription scope
Contributor: you bring your own certificate Contributor
Owner: the certificate is obtained for you Owner, or Contributor together with User Access Administrator
The Owner path creates a role assignment, which a Contributor cannot do. A Contributor who selects the Owner path fails at the role assignment, after the cluster has been created.
You also need quota for a small AKS cluster in the region you choose.

Register two resource providers

The deployment script runs as an Azure deployment script, which creates a storage account and a container instance behind the scenes. Azure does not register those providers automatically for this offer. A Contributor can register them, and the commands are safe to repeat:
az provider register --namespace Microsoft.ContainerInstance
az provider register --namespace Microsoft.Storage
az provider show -n Microsoft.ContainerInstance --query registrationState -o tsv
az provider show -n Microsoft.Storage --query registrationState -o tsv
Both must print Registered. Registration can take a few minutes.
If Microsoft.ContainerInstance is missing, the deployment fails after the cluster is created with MissingSubscriptionRegistration. A subscription that has never run Azure Container Instances usually does not have it.

Hostname and DNS

  • The hostname must have at least three labels and be a subdomain, for example securspaces.apps.example.com, never example.com. The wizard rejects common two-label names.
  • You must be able to create records in the zone that holds the parent of your hostname. For securspaces.apps.example.com, that is the apps.example.com zone, or example.com if apps is not a zone of its own.
  • Nothing can already exist at the hostname in that zone. Delete any existing CNAME or A record first.
  • Owner path: the hostname can be at most 64 characters. If the parent zone has a CAA record, it must allow letsencrypt.org, or the certificate is never issued and nothing answers on port 443.
After the deployment, you create one NS record set on the Owner path, or two CNAME records on the Contributor path. See After the deployment.

TLS certificate

SecurSpaces serves one certificate covering two names:
Name Example What it serves
<hostname> securspaces.apps.example.com The portal
*.proxy.<hostname> *.proxy.securspaces.apps.example.com One name for each running workspace
The proxy name is fixed. It is always proxy. followed by your hostname.
Owner path: nothing to prepare. The deployment obtains the certificate from Let's Encrypt and renews it. The private key is generated inside the cluster and never leaves it.
Contributor path: obtain the certificate before you deploy. See Obtain a certificate. A certificate from your organization's own certificate authority also works if it is issued for the same two names.
Important:
Obtain a certificate for these two names only. Do not reuse a certificate that covers other names in your domain. The private key is stored in the cluster as a Kubernetes Secret, which anyone with cluster-admin rights can read.
On the Contributor path, renewal is your task. See Renew the TLS certificate.

Policy constraints

Constraint What happens if a policy blocks it
The subscription permits privileged workloads The deployment fails after the Helm timeout. The Warning events in the deployment script log name the cause
The subscription permits AKS local accounts The deployment cannot install anything, and nobody can reach the cluster
If your tenant enforces a policy that disables AKS local accounts, this offer cannot be deployed there.

Why the cluster keeps local accounts

The cluster keeps the built-in AKS administrator account. The deployment script uses it to install the platform, which is what lets a Contributor deploy without creating a role assignment. You use it, through az aks get-credentials, when you must reach the cluster directly, for example to renew an expired certificate.
Important:
Anyone with Contributor on the managed resource group can retrieve a cluster-admin credential. It bypasses Microsoft Entra ID, so Conditional Access, multifactor authentication and Privileged Identity Management do not apply to it, and its use is not attributable to a person. Treat Contributor on that resource group as equivalent to cluster-admin. Disabling local accounts later is not possible on this cluster: it would stop every credential from working.

Outbound network destinations

All destinations use TCP port 443 unless stated otherwise.
During the deployment only:
Destination Purpose
citrixsecurspaces.azurecr.io SecurSpaces container images
*.blob.core.windows.net Image data served by the registry above. Without it, image downloads stop part-way
quay.io, cdn01.quay.io The ingress controller and, on the Owner path, the certificate manager. Without them the deployment can report success while nothing answers on port 443
registry-1.docker.io, auth.docker.io, *.docker.com Database images from Docker Hub
dl.k8s.io, github.com, api.github.com, raw.githubusercontent.com, get.helm.sh Kubernetes command-line tools downloaded by the deployment script
Permanently, for as long as the platform runs:
Destination Purpose
api.enterprise.strong.network Licensing. The platform renews its license every two hours. See Community Edition
Permanently, on the Owner path only:
Destination Purpose
acme-v02.api.letsencrypt.org Certificate issuance and renewal
login.microsoftonline.com Token exchange for the certificate manager
management.azure.com Writing validation records into the DNS zone
The four name servers of the deployment's DNS zone, on port 53 over TCP and UDP Checking validation records before issuance
When the first workspace is created: docker.io/strongnetwork/cloud_editor_generic, the default workspace image.
The deployment does not contact any Helm chart repository, so charts.bitnami.com, netscaler.github.io, kubernetes-sigs.github.io and percona.github.io can stay closed.
AKS has its own baseline outbound requirements. See Outbound network and FQDN rules for AKS.

What is not included
Installing into an existing cluster Not supported. The offer always creates a new cluster
Upgrades None. An installation stays on the version it was deployed with. Redeploying finds the existing installation and leaves it unchanged
Security fixes Not applied to a deployed installation. Moving to a newer version means deploying a new instance, which starts empty
Backups None. There is no database backup and no workspace-file backup. See Uninstall
Certificate renewal on the Contributor path Your task. See Renew the TLS certificate
Citrix Support Not included. Use the SecurSpaces community forum