Azure Marketplace installation

Deploy AI Fabrix from the Azure Marketplace managed application. This creates the platform in your Azure subscription before the tenant activation wizard runs.

Prerequisites

• Azure subscription with permission to deploy marketplace offers
• Resource group creation and role-assignment rights in the target
  subscription. The controller receives Contributor access in its managed
  resource group so tenant activation can create environment resources.
• Marketplace offer access for your organization (procurement may approve the plan first)
• Global Administrator (or equivalent) later, for Microsoft admin consent in the tenant activation wizard
• Application Administrator (or Cloud Application Administrator) later, if identity setup in the wizard requires it
• If you will use OpenAI or Azure OpenAI, provider access for the text models gpt-4o-mini and gpt-5.6-luna
  and the embedding model text-embedding-3-small. For Azure OpenAI, deploy them with those exact deployment names
  before tenant activation.

Where it happens

Deployment runs in your Azure subscription. When it succeeds, open the controller portal (URL in Step 3), then continue to tenant activation. See Azure services created for what ARM provisions and what the controller creates later during activation.

Five-step admin flow

Step 1 — Marketplace deployment

1. Open Azure Marketplace — find the AI Fabrix offer and start Create (or use your organization's private catalog).
2. Choose subscription and region approved by your cloud team.
   Azure OpenAI is created only when that region supports it and the optional account is enabled. The install does not
   move it to another region automatically; if unavailable, connect an existing provider during activation.
3. Set deployment parameters — use one install ID for the application name and Application resources Resource group
   name (for example acme). Azure uses it as the resource-name prefix. Choose the purchased capacity profile, set
   the administrator email and initial administrator password, and store the password in your enterprise vault. Entra application client credentials are established through the identity connection flow, not entered as Marketplace installation parameters.
4. Review and deploy — wait until Azure reports deployment Succeeded with no failed resources. Typical time is about 20 minutes.

Azure creates a managed resource group named for the install ID (for example acme). Details: Azure services created.

Step 2 — Platform infrastructure (automatic)

Azure creates the managed application infrastructure, controller, identity service, managed identity, storage, database, and other selected resources. The Entra enterprise application is not an ARM resource created by this step. For initial setup, use Connect Microsoft Entra ID instead of creating a duplicate SSO application. After one-time admin consent, the controller creates the enterprise application during the tenant activation wizard.

Step 3 — First login (emergency admin)

1. Open the controller portal. Prefer the URL in deployment outputs. If you construct it, use the install ID from
   the managed resource group as the prefix: https://{install-id}-miso-miso.azurewebsites.net.

You can also open the managed resource group in Azure and browse the App Service named {install-id}-miso-miso.

2. Sign in with the emergency admin account provided in onboarding materials.
3. Change the mandatory password immediately and store credentials in your enterprise vault.
4. Limit use of the emergency account to break-glass scenarios — personal SSO accounts replace it in Step 5.

Step 4 — Tenant activation wizard

Complete the tenant activation wizard until the tenant is ACTIVE (about 10 minutes). During consent and identity setup, an authorized directory administrator grants consent and the controller creates the SSO enterprise application, service principal, app roles, and related identity configuration. Do not start integrations before activation completes. If sign-in fails after logout, wait about 20 minutes — services may still be installing and URLs can change.

Step 5 — Create personal admin user

1. Create a named administrator account tied to corporate identity.
2. Confirm the administrator group is mapped to the intended platform role and environment; follow Assign groups to roles.
3. Verify SSO sign-in succeeds for daily operations.
4. Retire routine use of the emergency admin account.

Integrations wait until activation completes. Developers then use Developer workstation setup.

What this shows: Marketplace infrastructure deploy, bootstrap login, consent-driven enterprise application creation during tenant activation, then everyday SSO admin access.

What this is not: Integrator CLI or Role Assistant activation — those follow tenant ACTIVE. Manual Entra SSO is not an install step.

What done looks like

Validate

• Azure portal: deployment Succeeded
• Browser: controller portal loads at https://{install-id}-miso-miso.azurewebsites.net for the managed resource group {install-id}
• Tenant status: ACTIVE before integration work
• SSO sign-in works for the personal admin after the wizard

Limits

Detailed Azure resource names and parameter labels vary by marketplace offer version. Confirm the App Service name in
your managed resource group if the URL pattern above does not match. Deploy (~20 minutes) and tenant activation (~10
minutes) times are typical, not guaranteed. Marketplace bootstrap accepts a Marketplace subscription ID to resolve a
purchased plan; a direct deployment without that ID follows the Community-plan fallback. Confirm the plan shown during
activation before relying on a purchased entitlement.

Registry authentication and resource-group administration are separate. A
credential-based registry can omit a cross-tenant registry role assignment,
while the controller still needs Contributor access in its own managed resource
group.

Common mistakes