fix: restrict deployment to zone-redundant Fabric regions and fix Windows ARM64 Python env - #101
Conversation
…egions azd up failed when a location without Microsoft Fabric Capacity or availability-zone support was selected, and the failure surfaced late during provisioning with an unclear message. - Add @Allowed list to the location parameter in main.bicep, covering the 36 regions that support Microsoft Fabric Capacity, Azure Event Hubs, and availability zones (Event Hubs Standard namespaces are automatically zone redundant there). Default is now eastus2. - Wire location to AZURE_LOCATION in main.parameters.json so azd filters its location prompt and passes the selected region explicitly. - Document supported regions in the Deployment Guide and add a troubleshooting entry for the allowed-values error. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The postprovision hook failed on Windows ARM64 while installing requirements.txt: cryptography (pulled in transitively via azure-identity -> msal -> pyjwt[crypto]) has published no win_arm64 wheels since 46.0.3, so pip fell back to a source build that requires a Rust toolchain and OpenSSL and failed with 'Could not find directory of OpenSSL installation'. This is an architecture issue, not a Python version issue - an ARM64 build of Python 3.11 reproduces the failure identically. x64 interpreters resolve the win_amd64 wheels and run under emulation. - Get-PythonCommand now detects Windows ARM64 and prefers an installed x64 interpreter, discovered via 'py --list-paths' and known install locations. Behavior on all other platforms is unchanged. - Recreate .venv when its architecture no longer matches the selected interpreter, so a previously broken ARM64 venv is not silently reused. - Emit actionable guidance when dependency installation fails on an ARM64 interpreter. - Document the x64 requirement in the Deployment Guide and add a troubleshooting section for the hook and wheel-build failures. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR removes two azd up deployment blockers by (1) constraining the deployment region to Fabric + Event Hubs + availability-zone-capable regions and wiring the selected AZURE_LOCATION into the Bicep parameters, and (2) improving the Windows ARM64 postprovision Python bootstrap to prefer an x64 Python interpreter and recreate .venv when architectures don’t match.
Changes:
- Restricts
infra/main.biceplocationto an allowed list (defaulteastus2) and threads${AZURE_LOCATION}throughinfra/main.parameters.json. - Updates
Run-PythonScript.ps1to prefer x64 Python on Windows ARM64, detect venv/interpreter architecture mismatches, and emit clearer guidance on ARM64 wheel build failures. - Updates deployment/troubleshooting documentation for supported regions and Windows-on-ARM Python guidance.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| infra/scripts/utils/Run-PythonScript.ps1 | Prefer x64 Python on Windows ARM64; recreate .venv on arch mismatch; improve failure guidance. |
| infra/main.parameters.json | Wires location to ${AZURE_LOCATION} for azd-driven deployments. |
| infra/main.bicep | Restricts location to supported regions and defaults to eastus2. |
| docs/TroubleShootingSteps.md | Updates region guidance and adds Windows ARM64 Python/postprovision troubleshooting. |
| docs/DeploymentGuide.md | Adds “Supported Azure Regions” section and Windows-on-ARM x64 Python callout; updates anchors/links. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
| | Issue/Error Code | Description | Steps to Resolve | | ||
| |-------------|-------------|------------------| | ||
| | **Failed building wheel for cryptography /<br>failed to run custom build command for `openssl-sys`** | Windows ARM64 host using an ARM64 Python interpreter | The `postprovision` hook installs `requirements.txt`. On **Windows on ARM**, `cryptography` (pulled in transitively by `azure-identity` → `msal` → `pyjwt[crypto]`) has published no `win_arm64` wheels since version 46.0.3, so pip falls back to a source build that needs a Rust toolchain **and** an OpenSSL installation.<br><br>**Example error message:**<br>`Could not find directory of OpenSSL installation, and this `-sys` crate cannot proceed without this knowledge.`<br>`$HOST = aarch64-pc-windows-msvc`<br><br>**This is an architecture problem, not a Python version problem** — an ARM64 build of Python 3.11 fails exactly the same way as 3.12.<br><br>**Resolution:**<br><ul><li>**Install an x64 build of Python** (the "Windows installer (64-bit)" download, **not** "Windows installer (ARM64)") from [python.org](https://www.python.org/downloads/windows/)</li><li>**Confirm the interpreter architecture:**<br>`python -c "import platform; print(platform.machine())"`<br>Should print `AMD64`. If it prints `ARM64`, that interpreter will fail.</li><li>**Delete the stale virtual environment** so it is rebuilt against the x64 interpreter:<br>`Remove-Item -Recurse -Force .venv`</li><li>**Rerun:**<br>`azd up`</li></ul>💡 The `Run-PythonScript.ps1` helper automatically detects Windows ARM64 and prefers an installed x64 interpreter, and recreates `.venv` when its architecture doesn't match. You only need to act if **no** x64 Python is installed.<br><br>**Verify which interpreters you have:**<br>`py --list-paths`<br>Entries tagged `-arm64` are ARM64 builds; untagged entries are x64. | |
|
Alison (@alipouw13) please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
Contributor License AgreementContribution License AgreementThis Contribution License Agreement (“Agreement”) is agreed to by the party signing below (“You”),
|
4 similar comments
|
Alison (@alipouw13) please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
Contributor License AgreementContribution License AgreementThis Contribution License Agreement (“Agreement”) is agreed to by the party signing below (“You”),
|
|
Alison (@alipouw13) please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
Contributor License AgreementContribution License AgreementThis Contribution License Agreement (“Agreement”) is agreed to by the party signing below (“You”),
|
|
Alison (@alipouw13) please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
Contributor License AgreementContribution License AgreementThis Contribution License Agreement (“Agreement”) is agreed to by the party signing below (“You”),
|
|
Alison (@alipouw13) please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
Contributor License AgreementContribution License AgreementThis Contribution License Agreement (“Agreement”) is agreed to by the party signing below (“You”),
|
Summary
Two independent
azd upblockers hit while deploying this accelerator.1. Deployment failed depending on the region selected
locationininfra/main.bicepaccepted any region and was never wired intoinfra/main.parameters.json. Selecting a region without Microsoft Fabric Capacity or availability-zone support failed late in provisioning with an opaque error.@allowedlist of 36 regions tolocation, defaulting toeastus2. The list is the intersection of regions supporting Microsoft Fabric Capacity, Azure Event Hubs, and availability zones (Event Hubs Standard namespaces are automatically zone redundant there). Canary (*euap) regions excluded.locationto${AZURE_LOCATION}inmain.parameters.json, soazdfilters its location prompt and passes the selection explicitly.Failures now surface immediately at validation with the full list of valid regions.
2.
postprovisionhook failed on Windows ARM64Installing
requirements.txtfailed while buildingcryptographyfrom source:cryptography(transitive:azure-identity->msal->pyjwt[crypto]) has published nowin_arm64wheels since 46.0.3, so pip falls back to a source build requiring a Rust toolchain and OpenSSL.This is an architecture issue, not a Python version issue - an ARM64 build of Python 3.11 reproduces it identically, while x64 3.11 and 3.12 both succeed via the
win_amd64wheels under emulation.In
infra/scripts/utils/Run-PythonScript.ps1:Get-PythonCommanddetects Windows ARM64 and prefers an installed x64 interpreter (discovered viapy --list-pathsand known install locations). All other platforms are unchanged..venvis recreated when its architecture no longer matches the selected interpreter. Previously theTest-Pathcheck silently reused a broken ARM64 venv, so the failure persisted even after installing x64 Python.Docs
DeploymentGuide.md: new "Supported Azure Regions" section (table, verification commands, Fabric multi-geo note, region-change caveat); x64 Python callout for Windows on ARM. Renumbered subsequent sections and fixed anchors.TroubleShootingSteps.md: replaced a stale 8-region list; new "Python Environment & Postprovision Hook" section covering the wheel-build andcmdhook-postprovisionfailures.Testing
Region fix:
az bicep buildclean (only the pre-existingcreatedByunused-param warning)az deployment group validatewithlocation=westus-> rejected with explicit allowed-values messageaz deployment group validatewithlocation=eastus2-> Succeededazd provision --preview-> resolvedLocation: East US 2fromAZURE_LOCATIONand planned the Event Hubs namespace correctlyARM64 fix, on a Windows ARM64 host:
cryptography50.0.0 from wheelSeeded a broken ARM64
.venvto reproduce the reported state, then ran the real hook script:Also confirmed the non-ARM64 path still returns plain
python, and re-ran from a clean state. Temporary Azure resources and test artifacts were removed.Note on behavior change
Resources now deploy to
AZURE_LOCATIONrather than inheriting the resource group's location. When reusing an existing resource group in a different region, resources land in the selected region.