Deployment Guide
This guide takes a deployment engineer — with no prior CET2 exposure — from a blank environment to a fully onboarded customer tenant.
:::tip One structural fact that matters everywhere in this guide CET2 uses two separate Entra app registrations: a Portal application (user sign-in + API) and a Data application (certificate-based, app-only, per-tenant Graph access). Keep them distinct — most deployment confusion comes from conflating the two. :::
Hosting models
CET2 supports two deployment models. Pick one before you start.
| Model A — Azure App Service | Model B — Self-hosted container | |
|---|---|---|
| Status | Current production model | Container artifacts are on the roadmap |
| Compute | Azure App Service (Linux) | Any Docker/Kubernetes host |
| Graph certificate | Azure Key Vault via Managed Identity | Mounted local PFX file |
| Persistence | App Service filesystem (SQLite) | PersistentVolume (single replica) |
| Best for | MSP-hosted, multi-customer instances | Customers who require on-premises/private hosting |
The stages of a deployment
- Prerequisites — what the customer (and you) must have ready
- Azure App Registrations — create the Portal and Data applications
- Microsoft Graph Permissions — grant and understand the required scopes
- Server Installation — deploy the backend and frontend
- Configuration — wire up
appsettings/ app settings - SSL and DNS — public URL, certificate, and DNS records
- Tenant Onboarding — the full per-customer onboarding flow
- Validation Testing — the checklist to run before calling it done
- Troubleshooting — common failures and their fixes
What you'll need collected before you start
See Information Checklist for the full list — at minimum you need the customer's Entra tenant ID, a Global Administrator contact, the public portal URL, and their RBAC requirements (who should get access, and at what level).