1# Deploy & Track
2 
3Applies to all private network deployments.
4 
5## Deploy
6 
7```bash
8az deployment group create \
9  --resource-group <rg> \
10  --template-file main.bicep \
11  --parameters main.bicepparam \
12  --name <deployment-name>
13```
14 
15> ⚠️ Capability host provisioning is **asynchronous** (10–20 min). The CLI produces no output during this phase.
16 
17## Monitor Progress
18 
19Use exponential backoff — do NOT poll every 30 seconds.
20 
21| Poll | Wait |
22|------|------|
23| 1st | 1 min after deploy starts |
24| 2nd | 3 min after 1st |
25| 3rd | 5 min after 2nd |
26| 4th+ | Every 5 min |
27 
28```bash
29# Overall state
30az deployment group show \
31  --resource-group <rg> --name <deployment-name> \
32  --query "{state:properties.provisioningState,error:properties.error}" -o json
33 
34# Per-resource progress
35az deployment operation group list \
36  --resource-group <rg> --name <deployment-name> \
37  --query "[].{resource:properties.targetResource.resourceType,state:properties.provisioningState}" -o table
38```
39 
40Or block with timeout:
41 
42```bash
43az deployment group wait \
44  --resource-group <rg> --name <deployment-name> \
45  --created --timeout 1800
46```
47 
48## Error Recovery
49 
50When a deployment fails, follow this workflow:
51 
52### Step 1 — Identify the error
53 
54```bash
55az deployment operation group list \
56  --resource-group <rg> \
57  --name <deployment-name> \
58  --query "[?properties.provisioningState=='Failed'].{resource:properties.targetResource.resourceType,error:properties.statusMessage}" \
59  -o json
60```
61 
62### Step 2 — Resolve
63 
64Use `microsoft_docs_search` with the error code or message to find current remediation. The legionservicelink retry rule is documented in the main workflow's Error Handling section.
65 
66| Error | Likely cause | Fix |
67|-------|-------------|-----|
68| `legionservicelink` / subnet in use | Orphaned service link from prior attempt | Use a new `vnetName` — do not reuse the prior VNet |
69| `AuthorizationFailed` on `validate/action` | Missing Contributor role | Assign Contributor + User Access Administrator to deploying identity |
70| `SubnetDelegationAlreadyExists` | Agent subnet already delegated to another resource | Use a new VNet or open a support ticket to remove the delegation |
71| `disableLocalAuth` policy violation | Template defaults to `false` | Set `disableLocalAuth: true` in Bicep params |
72| `defaultOutboundAccess` policy violation | Subnets missing the property | Add `defaultOutboundAccess: false` to subnet properties |
73 
74### Step 3 — Present fix to user and get approval
75 
76Before re-deploying, show the user:
77- What failed and why
78- What file/parameter will be changed
79- The new `vnetName` to use (must be different from the failed run)
80 
81### Step 4 — Re-deploy with a new deployment name
82 
83```bash
84# Update main.bicepparam: change vnetName to a new unique name
85az deployment group create \
86  --resource-group <rg> \
87  --template-file main.bicep \
88  --parameters main.bicepparam \
89  --name <deployment-name>-retry
90```
91