One-Click Deploy to Azure
For Model A deployments, an ARM/Bicep template automates most of Server Installation — provisioning the App Service, Key Vault, Application Insights, and Managed Identity in one step, with the app settings from Configuration pre-filled.
What it provisions
- An App Service (Linux, .NET 10) with a System-assigned Managed Identity
- A Key Vault, with the App Service's identity granted Key Vault Secrets User
- Application Insights
- All
AzureAd:*andCet2:*app settings, pre-filled from the parameters you supply
What it deliberately doesn't do
:::info Do these three things first — the button needs them Azure Resource Manager cannot create Entra objects or handle a private key, and this template provisions empty compute. Specifically:
- Create the two Entra app registrations (Azure App Registrations) — you need their client IDs as parameters before clicking deploy.
- Upload the Graph certificate to Key Vault — done after the template runs, directly against the vault it creates, so the private key never touches a deployment template or its history.
- Deploy the application code — the button provisions the App Service shell; the actual CET2
binary is deployed afterwards (via CI/CD or
az webapp deploy). :::
Parameters you'll be asked for
| Parameter | What to enter |
|---|---|
namePrefix | A short, globally-unique prefix, e.g. cet2-contoso |
brandName | The product name shown in the portal — defaults to ClefSoft Endpoint Toolkit. See White-Labelling |
portalClientId | The Portal app registration's client ID |
dataClientId | The Data app registration's client ID |
homeTenantId | Your MSP/home Entra tenant ID |
bootstrapAdminObjectId | The Entra object ID to seed as the first Platform Super Administrator |
appServiceSku | B1 is a sensible production default; F1 (free) is fine for evaluation |
After deployment
The deployment's outputs tell you exactly what's left — the Key Vault name to upload the certificate to, and the App Service hostname to register as a redirect URI. Continue with SSL and DNS and then Tenant Onboarding.
Full parameter reference and the underlying Bicep source live in the public cet2-deploy repository — kept separate from the main CET2 source so the Deploy to Azure button can fetch its template publicly.