Skip to main content

Deploy from Azure Marketplace

Cloud Connector is deployed from the Azure Marketplace as a Managed Application: a locked resource group in your subscription that you can read, and that Datawareness can reach for support and maintenance. This page walks an administrator through the plans, the wizard and the steps before the first dataset can be loaded.

Plans​

PlanWhat you bringWhat the deployment creates
Basic, StandardTwo app registrationsContainer Apps, an Azure DocumentDB (MongoDB vCore) cluster, a storage account, a virtual network with private endpoints, optionally a NAT Gateway
EnterpriseThe same, optionally your own MongoDB connection stringThe same; no cluster when you bring your own database
Enterprise advanced management (private offer)Your own database, storage account, Azure OpenAI resource, Key Vault, managed identity and a subnet in your own virtual networkOnly the Container Apps, built into your subnet. No secret of yours is ever stored in the managed resource group, and Datawareness reaches it only through a just-in-time request you approve

The three standard plans differ in feature limits, not in what they deploy; see Plan Tiers and Feature Limits. The advanced-management plan carries the Enterprise feature set.

Prerequisites​

For every plan:

  • An Azure subscription with permission to deploy managed applications.

  • Two Microsoft Entra ID app registrations in your tenant, each with a client secret:

    • Cloud Connector — the UI's sign-in and the backend API's identity.
    • Cloud Connector Service — the Python service's identity.

    App registrations describes both, including the scope, app roles and API permissions each needs. The wizard links to the same guide as a PDF.

  • Optional, and only when Power BI or other tools should read loaded data: a third registration, Cloud Connector Data, for the Data API. It can be added any time after deployment, see Data Access and the Data API.

For Enterprise with your own MongoDB: a connection string without a database name in the path (end the host with / followed by ? and any options). Cloud Connector appends its own configuration and data databases. The instance must be reachable from the deployed Container Apps; if it restricts access by IP, keep the NAT Gateway enabled and allow-list its outbound IP.

For Enterprise advanced management, additionally: a Key Vault using the Azure RBAC permission model holding the seven secrets Cloud Connector reads at run time, a user-assigned managed identity with Key Vault Secrets User on that vault, a database, a storage account with the two containers ai-import-payloads and sql-export-staging, optionally an Azure OpenAI resource, and a virtual network with a delegated /27 subnet. The prerequisites guide for that plan comes with a preparation script that does all of it in one run.

Run the deployment wizard​

Basic, Standard and Enterprise collect, in this order:

  1. Basics — subscription, resource group, region, and the Resource name prefix. It becomes the prefix of every deployed resource, so pick something short, lowercase and unique to your organisation.
  2. Database — Compute tier (M10 with 1 vCore and 2 GB up to M80 with 32 vCores and 128 GB), Storage (GB), Storage type (Premium SSD, or Premium SSD v2 for higher IOPS in fewer regions), Admin username and password. The storage type cannot be changed afterwards. On Enterprise the step starts with Database source: Provision a new Azure DocumentDB cluster or Use my existing MongoDB connection string.
  3. Infrastructure — NAT Gateway (stable outbound IP): Enabled (recommended for external SQL whitelisting) or Disabled (use Azure-managed SNAT). Some external systems only accept connections from approved IP addresses; a NAT Gateway gives Cloud Connector a single, fixed outbound IP.
  4. Authentication — Azure AD Tenant ID, then Client ID and Client secret for Cloud Connector (Backend API) and for Cloud Connector Service (Python Service).
  5. Review — a summary of what will be created, then Create.

Enterprise advanced management collects instead: Key Vault (the vault, the User-assigned managed identity, and the Secret name — data encryption key), Database, storage and AI (the secret names for the configuration and data databases and for the storage connection string; the AI provider: My Azure OpenAI resource with its endpoint and key secret name, or None (AI features disabled)), Network (Virtual network, Subnet name, and an optional Outbound public IP for display), Authentication (tenant ID, and for each registration the Client ID and the Client secret name in your vault), JIT Configuration, and Review.

danger

Never create a new version of the data encryption key secret once Cloud Connector is running. Every credential you have saved is encrypted with it, and a new version makes all of them unreadable. Every other secret in the vault can be rotated freely.

After deployment: activation and redirect URIs​

Activation by Datawareness. When the deployment completes, the three Container Apps run a temporary provisioning placeholder and the application URLs show a placeholder page. Datawareness performs the final installation step that brings the services online, and on the Standard and Enterprise plans provisions the Azure OpenAI deployment the AI features use. Datawareness coordinates this with you as part of onboarding; nothing further is needed from you in the wizard.

Redirect URIs. The Outputs blade of the managed application shows the UI URL and the API URL. Open the Cloud Connector app registration in Microsoft Entra ID and add two redirect URIs on the Authentication blade:

  1. Under Single-page application — the UI URL (for example https://ccui-….azurecontainerapps.io). The browser uses it to sign users in.
  2. Under Web — the API URL followed by /api/auth/oauth/callback. The Connect… button on Microsoft sign-in actions and instances returns here. Without it, the popup that opens after sign-in stays blank.

The platform choice matters: Web lets the API finish the token exchange with the deployment's client secret; SPA enables the browser-side flow. Putting either URI under the wrong platform breaks the corresponding flow.

Rotating a client secret​

Basic, Standard and Enterprise. The two client secrets are stored on the deployment itself, not in Cloud Connector's settings, and the managed resource group is read-only to you. Create the new secret on the app registration in Microsoft Entra ID, then ask Datawareness support to apply it to the deployment; delete the old secret once the new one is in use. Setup → Access shows when the Cloud Connector secret expires, and the failure-notification recipients receive a warning email 30, 14 and 7 days before expiry and again when it has expired.

Enterprise advanced management. Create a new version of the secret in your own Key Vault. It takes effect within 30 minutes with no redeployment.