Skip to main content

End-to-End Deployment Runbook

A concise, linear checklist for an engineer to follow start to finish. Each step links back to the detailed page it's drawn from.

Pre-flight (once per MSP instance)​

  1. Create App 1 — Portal (multitenant): SPA redirect URI = your portal URL; expose the access_as_user scope; add the auth_time optional claim to the access token. Record its client ID. → Azure App Registrations
  2. Create App 2 — Data (multitenant): upload the Graph certificate's public key; add the required Graph application permissions. Record its client ID. → Azure App Registrations, Graph Permissions
  3. Provision hosting:
    • Model A: App Service + Managed Identity + Key Vault (holding the certificate) + grant the Managed Identity Key Vault Secrets User.
    • Model B: build the container, mount the certificate/PFX, provision a PersistentVolume for the SQLite file. → Server Installation

Deploy​

  1. Set configuration: AzureAd:{Authority, Audience, TenantId} and Cet2:{GraphAuth.*, BootstrapAdminObjectIds, Actions.Enabled=false}. → Configuration
  2. Deploy the API. Confirm GET /api/health returns ok.
  3. Add the portal URL to App 1's redirect URIs. Verify an MSP administrator can sign in. → SSL and DNS

Per customer tenant​

  1. The customer's Global Administrator admin-consents App 2, and — only if enabling sensitive actions — assigns User Administrator and/or Authentication Administrator to its service principal.
  2. Tenants → Onboard the customer's tenant ID; the probe must pass.
  3. Verify live data (Devices, Compliance). Run the full Validation Testing checklist.
  4. In Access Control, assign the customer's users/groups a role scoped to their tenant.
  5. Customer users sign in with their own accounts and see only their own tenant. → Tenant Onboarding

Go-live​

  1. (Optional) Enable write actions: confirm certificate authentication is in place, set Cet2:Actions:Enabled=true, validate a low-risk action (Device Sync) end to end, and confirm it appears in the target's Action history.
  2. Apply Conditional Access to the app registrations before production customer use.

That's the whole deployment, start to finish. If something doesn't behave as expected at any step, the Troubleshooting page is organised by symptom and maps directly onto this runbook.