Add Environment Validator TSG: AzStackHci_Subscription_State

[John Neemes (1008covingtonlane)]

What

Adds a public Environment Validator remediation TSG for AzStackHci_Subscription_State (ADO 38356879), which confirms the cluster's Azure Stack HCI subscription is Active during Deployment, Update, and Upgrade readiness. No TSG existed for this validator, so front-line support had nothing to point a customer at.

How it was grounded (source + telemetry, not guessed)

• Product source: the check is Test-AzureStackHCISubscriptionState (ASZ-EnvironmentValidator, AzStackHci.ArcIntegration.Helpers.psm1). It runs Get-AzureStackHCISubscriptionStatus per node, selects the Azure Stack HCI subscription, and reports FAILURE when the cmdlet errors, no subscription is found, or SubscriptionStatus != 'Active'; SUCCESS only when Active.
• Live telemetry: harvested the real failure Detail signatures from EnvironmentValidatorResult and grouped them into the three sub-modes the guide branches on. Also confirmed the check currently PASSES fleet-wide (~4,069 clusters), so the guide is honest that a genuinely-disabled subscription is the rarer case.

Structure

Standard sibling house style (at-a-glance table, Overview, Requirements, Troubleshooting Steps 1-6, Glossary):

• Detection: HealthCheckResult JSON, the EventID 17205 event-log query, the portal Updates tab, and the authoritative on-box Get-AzureStackHCISubscriptionStatus.
• Three failure sub-modes, each with its own owner and fix: subscription not Active (Azure subscription/billing), cannot read the subscription (connectivity/registration, with the firewall-requirements reference), and no subscription found (re-registration).
• Per-node identification, consequences, per-sub-mode remediation with risk labels, and verification via Invoke-SolutionUpdatePrecheck -SystemHealth.
• Cross-links the related MSI-access, external-connectivity, and DNS guides. Indexed in the EnvironmentValidator README.

Validation

Graded with the tsg-forge harness: static structure/safety lint Grade A and a 13-persona usability panel at 5/5. This is a cloud/subscription check whose genuinely-disabled failure is not safely injectable on a shared lab (and it only runs on a real Arc-registered cluster), so it is documented and statically graded rather than driven through a live inject loop.

[Copilot]

Pull request overview

Adds an Environment Validator troubleshooting guide for AzStackHci_Subscription_State.

Changes:

• Documents detection, failure modes, remediation, and verification.
• Adds the guide to the Environment Validator index.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
Troubleshooting-AzStackHci_Subscription_State.md	Adds the subscription-state TSG.
README.md	Links the new guide.

[T.J. Hambley (tihamble)]

Went over this against the merged EnvironmentValidator TSGs and the Az.StackHCI references, and ran the lint. The three sub-mode split, the risk labels, the cross-links, and the check name all hold up, Register-AzStackHCI -RepairRegistration matches the existing registration guides and the tracking item, and the lint is clean (its two hits are a false positive on the https:// in a Learn link and an intentional empty catch on a read-only parse).

One correctness fix before this goes in.

In step 1, the Event ID 17205 event-log query projects a bare top-level Status:

Select-Object -First 10 Status, @{n='Source';e={$_.AdditionalData.Source}}, @{n='Detail';e={$_.AdditionalData.Detail}}

On these records the top-level Status is a numeric enum, not the FAILURE/SUCCESS string, so that column comes back as a number. The readable value is under AdditionalData, which is where this same query already reads Source and Detail, and where the HealthCheckResult block just above it reads Status (Status = $_.AdditionalData.Status). The External DNS Resolution TSG in this same folder calls it out directly ("the top-level Status is a numeric enum"). Project it the same way:

Select-Object -First 10 @{n='Status';e={$_.AdditionalData.Status}}, @{n='Source';e={$_.AdditionalData.Source}}, @{n='Detail';e={$_.AdditionalData.Detail}}

[LOW RISK], it is a read-only detection query and the change only affects how the column is projected.