Attempting to deploy a VM, Automation account and Update Manager in one script. Failed provisioning state.

[HelloPackets89]

Hi there,

As the title suggestions, I'm attempting to write a BICEP script that performs the following:

1. Deploys a VM and all of its pre-requisites
2. Deploys an Automation Account
3. Deploys a Log Analytics Workspace
4. Links the two together
5. Deploys Azure Update Manager

The below script results in step 5 failing with the following not very useful error message:
"The resource write operation failed to complete successfully, because it reached terminal provisioning state 'Failed'."

I've ran steps 1-4 successfully in insolation but received the same error when attempting step 5 afterwards.
Please see below for my script:

// This BICEP script deploys a standalone VM with a public IP
// This deployment spins up faster and is cheaper than using a Bastion accessible lab
// Access to the VM in this deployment is via RDP , 3389 has been opened in the NSG.
// This script uses static PIP DNS names to allow the user to connect to a static RDCMan entry
// This script can be ran out of the box
// This will then create an Automation account with accompanying LAW to test AUM

// Parameters
param location string = 'australiaeast'
param lawname string = 'MyLAW'
param automationAccountName string = 'MyAutomation'

@minLength(10)
@secure()
param adminPassword string 
//The static DNS Name of your VM, choose something unique to you
param PIPDNSName string = 'myownspecialdnsname4512'

param adminUser string = 'souperadmin'
param vmsize string = 'Standard_B2s'
//For shutdown notifications
param contact string = 'test@domain.com'
param autoshutdowntime string = '2000'

//Assigns a semi-random number to the deployment.
// utcnow is used in-lieu of a random number generator.
param baseTime string = utcNow('mmss')
param vmName string =  ('test${baseTime}')



//select Australian timezone
@allowed([
  'AUS Central Standard Time'
  'AUS Eastern Standard Time'
  'Cen. Australia Standard Time'
  'E. Australia Standard Time'
  'W. Australia Standard Time'
  'Tasmania Standard Time'
])
param timezone string = 'W. Australia Standard Time'

//Network Security Group
resource nsg 'Microsoft.Network/networkSecurityGroups@2022-11-01' ={
  name: '${vmName}NSG'
  location:location
  properties:{
    securityRules:[
      {
        name:'RDP'
        properties:{
          access: 'Allow'
          direction: 'Inbound'
          priority: 100
          protocol: 'Tcp'
          sourcePortRange: '*'
          destinationPortRange: '3389'
          destinationAddressPrefix: '*'
          sourceAddressPrefix: '*'

        }
      }
    ]
  }
}

//Virtual Network
@description('defines the network')
resource virtualNetwork 'Microsoft.Network/virtualNetworks@2022-11-01' = {
  name: '${vmName}vnet_1'
  location: location
  properties: {
    addressSpace:{
      addressPrefixes: [
        '10.0.0.0/16'
      ]
    }  
  } 
}

//Default Subnet
var subnetname = '${virtualNetwork.name}/default'
resource subnet 'Microsoft.Network/virtualNetworks/subnets@2022-11-01' = {
  name: subnetname
    properties:{
    addressPrefix: '10.0.1.0/24'
  }
}

//VM PIP
resource pip 'Microsoft.Network/publicIPAddresses@2022-11-01' = {
  name: '${vmName}pip'
  sku:{
    name:'Basic'
  }
  location: location
  properties:{
    publicIPAllocationMethod:'Dynamic'
    dnsSettings:{
      domainNameLabel: PIPDNSName
    }
       
  }
}

//VM Nic
var nicname = '${vmName}nic'
resource vmnic 'Microsoft.Network/networkInterfaces@2022-11-01' = {
  name: nicname
  location: location
  dependsOn: [
    virtualNetwork
  ]
  properties:{
    networkSecurityGroup: {
      id: nsg.id
    }
    ipConfigurations:[
      {
        name: 'interface1'
        properties:{
          subnet:{
            id: subnet.id
          }
          privateIPAllocationMethod:'Dynamic'
          publicIPAddress:{
            id: pip.id
          } 
        } 
      }
    ]
  }
}



//Actual Virtual Machine
resource vm 'Microsoft.Compute/virtualMachines@2023-03-01' ={
  location: location
  name: vmName
  properties:{
    hardwareProfile:{
      vmSize:vmsize
      
    }
    networkProfile:{
      networkInterfaces:[
        {
          id: vmnic.id

        }
      ]
    }
    osProfile:{
      adminPassword:adminPassword
      adminUsername:adminUser
      computerName:vmName
      windowsConfiguration:{
        timeZone: timezone
      }

    }
    storageProfile:{
      imageReference:{
        publisher:'MicrosoftWindowsServer'
        offer: 'WindowsServer'
        sku: '2022-Datacenter'
        version: 'latest'
      }
      osDisk:{
        createOption:'FromImage'
        name:'${vmName}OSdisk'
        diskSizeGB: 128
        managedDisk:{
          storageAccountType:'Standard_LRS'
        }
      }
    }
    diagnosticsProfile:{
      bootDiagnostics:{
        enabled:false
      }
    }
    scheduledEventsProfile:{
      osImageNotificationProfile:{
        enable:true
        
      }
      terminateNotificationProfile:{
        enable:true
      }
    }
  }
  
}

//Set VM Autoshut down. "shutdown-computevm-<VMNAME>" is a reuqired name.
resource autoshutdown 'Microsoft.DevTestLab/schedules@2018-09-15' ={
  name: 'shutdown-computevm-${vm.name}'
  location: location
  properties:{
    status: 'Enabled'
    notificationSettings:{
      emailRecipient: contact 
      status:'Enabled'
      timeInMinutes: 15
      notificationLocale: 'en'
    }
    dailyRecurrence:{
      time: autoshutdowntime
    }
    timeZoneId:timezone
    taskType: 'ComputeVmShutdownTask'
    targetResourceId: vm.id

  }
}


resource law 'Microsoft.OperationalInsights/workspaces@2020-03-01-preview' = {
  name: lawname
  location: location
  properties: {
    sku:{
      name:'PerGB2018'
    }
  }
}

resource automationAccount 'Microsoft.Automation/automationAccounts@2020-01-13-preview' = {
  name: automationAccountName
  location: location
  properties: {
    sku: {
      name: 'basic'
    }
  }

}

var linkname = '${law.name}/Automation'
resource law_link 'Microsoft.OperationalInsights/workspaces/linkedServices@2020-08-01' = {
  //parent: law
  name: linkname
    properties: {
    resourceId: automationAccount.id
  }
}

//all the below properties are required. Removing any of the below will result in deployment errors. 
//unneccessary dependencies added as part of troubleshooting
resource updateManagement 'Microsoft.Automation/automationAccounts/softwareUpdateConfigurations@2017-05-15-preview' = {
  parent: automationAccount
  name: 'default'
    dependsOn:[
      law
      law_link
      vm
      automationAccount
  ]
  properties:{
    scheduleInfo: {
      frequency: 'Week'
      startTime:'2023-07-13T18:00:00+08:00'
      expiryTime:'2033-07-13T18:00:00+08:00'
      timeZone: timezone
      isEnabled: true 
      interval: 1
           
    }
    updateConfiguration: {
      azureVirtualMachines:[
        vm.id
      ]
      duration: 'PT3H'
      operatingSystem: 'Windows'
      windows:{
        excludedKbNumbers: []
        includedKbNumbers: []
        rebootSetting: 'IfRequired'
        includedUpdateClassifications: 'Critical, Security'

      }
      
    }
  }
}

[brwilkinson]

Here is a reference template

• https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/OMS.bicep#L1055C1-L1170C3

[brwilkinson]

@HelloPackets89 please provide a update on your progress?

[HelloPackets89]

Apologies @brwilkinson shortly after opening this request i lost all time to actually work on it

I've had a chance to run through this and have a few comments / queries:
The main issue I have with the error messages, the accompanying documentation and reviewing the provided example is its very difficult to tell what exactly the problem with my script is. It essentially comes down to 'trial and error' where I keep making changes until I get different errors or if it fails at different steps. This was fine up to the point where the error messages stopped being verbose.

Another problem I noticed was that the Azure Portal deploys AUM differently to how you would via BICEP/JSON so deploying via portal and reverse engineering the resulting template isn't possible. I found this out when I realised my BICEP script had to include a VM that I intended to add to the Update Manager whereas deploying from Portal didn't have this requirement.

I've compared scripts and have found the notable differences:

1. The example uses a loop combined with a batchsize decorator
2. The example script uses tags to assign VMs whereas mine assigns a vm explicitly.
3. The example script script schedules the run dynamically whereas mine is explicit. If I schedule a time too close the script will throw a verbose error for this which is not a problem.
4. The example has an advanced schedule specifying Wednesday/Thursday. I included this but still received a failure error.

Is there anything from the from example script that I've missed?
Is there a way to drill down the below error further to see what exactly is failing in my deployment?

"details": [
{
"code": "ResourceDeploymentFailure",
"target": "/subscriptions/658ddd8d-38ee-431a-a634-4fd00e4f7ce7/resourceGroups/Lab2/providers/Microsoft.Automation/automationAccounts/BrandonAutomation/softwareUpdateConfigurations/default",
"message": "The resource write operation failed to complete successfully, because it reached terminal provisioning state 'Failed'."