Customer Prerequisites
Infrastructure
| Requirement | Model A (App Service) | Model B (Self-hosted) |
|---|---|---|
| Server / compute | Azure App Service (Linux, B1+ recommended) | Linux host or Kubernetes/k3s node; ~1 vCPU / 1 GB minimum |
| Operating system | Managed by Azure | Any container host (Docker 24+ / containerd) |
| Runtime | .NET 10 (provided by App Service) | .NET 10 ASP.NET runtime, packaged inside the container image |
| Persistent storage | App Service filesystem (holds the SQLite metadata file) | A PersistentVolume for the SQLite file — run a single replica, SQLite is single-writer |
| SSL certificate | Managed certificate, or a custom domain certificate on App Service | TLS terminated at the reverse proxy / ingress (e.g. cert-manager + Let's Encrypt) |
| DNS | CNAME/A record for the portal hostname → App Service | A/CNAME → your ingress or reverse proxy |
Azure requirements
- Azure subscription — required only for Model A. Not needed for Model B.
- Microsoft Entra ID — required for both models; Entra is the identity provider and the source of every piece of data CET2 shows. Entra ID P1 is recommended (needed for Conditional Access step-up and other governance features).
- Intune licensing — the customer tenant must be Intune-licensed and actively enrolling devices, or the device/compliance/app pages will simply be empty (this is expected, not a bug).
Administrative access required
| Role | Where | Why |
|---|---|---|
| Global Administrator (or Privileged Role Admin + Application Admin) | Customer tenant | Grants admin consent to the CET2 Data application; assigns directory roles to its service principal |
| Application Administrator | MSP / home tenant | Creates and manages the two app registrations |
| Intune Administrator | Customer tenant | Useful for validating Intune data/actions; not required to run CET2 |
| Privileged Role Administrator | Customer tenant | Assigns User Administrator / Authentication Administrator directory roles to the Data application's service principal — required only if enabling user disable/enable and Temporary Access Pass |
Information checklist
Collect this from the customer before you start the deployment.
| Item | Why required | Example |
|---|---|---|
| Tenant ID (Directory ID) | Registered in CET2's tenant registry; used for token-issuer validation | 39aa2547-df4b-4d7d-ba70-22e645f16847 |
| Tenant / organisation name | Displayed in the portal | Contoso Ltd |
| Primary domain | Tenant identity, onboarding mapping | contoso.onmicrosoft.com / contoso.com |
| Azure subscription ID (Model A only) | Hosts the App Service / Key Vault | xxxxxxxx-… |
| Consent administrator account | The admin who will grant consent and assign roles | admin@contoso.com (Global Admin) |
| Public portal URL | Used as the SPA redirect URI and API base | https://cet.contoso.com |
| Certificate details | The Graph app-only certificate whose public key is uploaded to the Data app | CN, thumbprint, expiry date |
| RBAC requirements | Who should get access, and at what level | "Helpdesk group → Service Desk, scoped to Contoso" |
| Allowed users / groups | RBAC assignment targets | Helpdesk group object ID |
| Intune status | Confirms data will actually populate | "Intune active, ~120 devices enrolled" |
| Sensitive-action scope | Whether disable/enable, reset access, and wipe should be enabled | "View-only" vs "full remediation" |
Continue to Azure App Registrations.