When you deploy AI Fabrix from Azure Marketplace, Azure provisions a managed application stack in your subscription. Resource names and SKUs follow the parameters you enter during deployment — this page describes the typical components platform admins should expect.
Why it matters
Cloud and security teams need a shared map of what was created, which resources hold secrets, and where to open the controller portal before integrators connect systems or Role Assistants go live.
Typical resources
Marketplace deployment creates the Azure resources below. The Entra enterprise application is the exception: after admin consent, the controller creates it during tenant activation. You do not configure these components one by one after the offer succeeds.
| Azure service | Role in AI Fabrix |
|---|---|
| Managed application | Marketplace offer instance in your subscription |
| Resource group | Named with the install ID (for example acme) — container for deployed resources |
| Enterprise application | Created by the controller during tenant activation after one-time admin consent; it is not an ARM resource in the managed resource group. Use the Entra connection guide for initial setup, then manage group-role assignments separately. |
| Managed identity | Platform identity App Services use to reach Key Vault and Azure |
| App Service plan | Hosts the controller and identity services; its SKU follows the Marketplace capacity profile |
| App Service (controller) | Admin portal and tenant activation — named {name}-miso-miso |
| App Service (identity) | Sign-in service for the emergency admin account |
| Azure OpenAI account (conditional) | Created only when enabled and available in the install region; otherwise the deployment reports why it was skipped. You can connect an existing provider during tenant activation. |
| Azure Database for PostgreSQL | Platform metadata, integration config, operational records |
| Storage account | Documents, sync artifacts, backup payloads as configured |
| Key Vault | Secrets, certificates, connection strings resolved at runtime |
| Virtual network / subnets | Network isolation for App Services and data services |
| App Service logs / optional Application Insights | Platform logs remain enabled; Application Insights is optional and disabled by default |
Exact resource counts depend on marketplace offer version and sizing preset. Processing (dataplane) App Service is typically added during tenant activation, not always present immediately after Marketplace deploy.
The selected capacity profile sizes the foundation App Service plan and
PostgreSQL service. It does not pre-create every workload environment resource.
The controller creates those resources during the activation lifecycle using
its Contributor assignment in the managed resource group.
Controller portal URL
Open the controller from deployment outputs, or use the managed resource group install ID as the URL prefix:
https://{install-id}-miso-miso.azurewebsites.net.
Resource group acme → controller https://acme-miso-miso.azurewebsites.net
In the Azure portal: Resource groups → {install-id} → App Service {install-id}-miso-miso → Browse.
What this shows: Which Azure building blocks support AI Fabrix after Marketplace deploy, plus the enterprise application the controller creates during tenant activation.
What this is not: A bill of materials for every SKU variant, and not a manual Entra SSO runbook — confirm names in your Azure portal resource group.
The Azure OpenAI branch is conditional; check the deployment outputs before expecting that account in the resource group.
After deployment
- Open the controller portal using the URL pattern above.
- Continue Azure Marketplace installation from first login (emergency admin), then the tenant wizard and personal admin.
- Hand off to integrators only after tenant status is ACTIVE.
Review application updates
Before updating a managed platform application, review the settings preview in
the Controller. It separates settings that will be added or updated from
settings marked Kept as installed. A kept setting differs from the current
application default and remains unchanged, so an update does not silently
replace installation-specific values such as deployment mode or environment.
Resolve any Required settings have no value message under Settings →
System Secrets before continuing. After deployment, retain the deployment
status and its installed-image reference with the change record. That reference
is the image handed to the deployment provider; it is stronger evidence than a
manifest tag alone. A missing installed-image field is an evidence gap, not
proof that the requested tag was installed.
Validate
- Azure portal: every resource in the
{install-id}managed resource group shows Succeeded - Entra: enterprise application exists after admin consent and identity setup during tenant activation
- Browser:
https://{name}-miso-miso.azurewebsites.netloads the controller - Key Vault: secrets accessible to App Services (no misconfigured access policies)
- Update preview: intended changes are listed; Kept as installed names match
the values your installation must preserve - Deployment status: installed-image reference is retained when the deployment
path reports it
Limits
Private networking, multi-region, and exact App Service plan SKUs vary by offer. Treat this diagram as orientation — not
a contractual topology. If your managed resource group does not use the install ID, use the App Service named
*-miso-miso in that group instead of the URL formula. Purchased-plan resolution uses Marketplace subscription and
tenant metadata during bootstrap; those values are not additional Azure services in the resource group.