Set up in your Azure

Three steps. No script.

foundAItion runs inside your company’s own Azure, in one resource group. Your IT admin gives us access to that group in the Azure portal. Nothing to install, nothing to run, and you can take the access back at any time.

How it works

  1. Step 1

    Name your company and pick a region

    We turn the name into a short name for one new resource group. Only EU regions are offered.

  2. Step 2

    Select Deploy to Azure

    The Azure portal opens a short form from us. Sign in as someone with the Owner role on the subscription.

  3. Step 3

    Select Create in Azure

    Azure creates the resource group and gives our build service access to that group only. We build the rest inside it.

We derive a short name from it for your resource group.

Enter your company name first.

The exact access

One resource group. Two roles. Nothing else.

The access is two role assignments on the resource group <short name>-foundaition-rg, for our build service. You keep Owner of your subscription.

The roles our build service gets on the resource group
Role, on the resource group onlyWhyWhat it can not do
Contributorb24988ac-6180-42a0-ab88-20f7382dd24cBuild and run the software inside the group: database, vault, container apps, registry, storage and logs.Give anyone access, or touch anything outside the group.
Role Based Access Control Administrator, limitedf58310d9-a9f6-439a-9e8d-f62e7b41a168The software's own identities need the five roles below to read secrets, pull images and store files.Give any other role, give any role to a person or a group, or reach outside the group. An Azure condition on the role enforces this limit.

The only roles we can give, and only to the software’s own managed identities

  • Key Vault Secrets UserThe app reads its secrets4633458b-17de-408a-b874-0445c86b69e6
  • Key Vault Secrets OfficerThe build stores the secrets it generatesb86a8fe4-44ce-4948-aee5-eccb2c155cd7
  • AcrPullThe app pulls its container images7f951dda-4ed3-4680-a7ca-43fe172d538d
  • Storage Blob Data ContributorThe app's file storageba92f5b4-2d11-453d-a403-e96b0029c9fe
  • Cognitive Services UserOpen-weight AI models (off by default)a97b65f3-24c7-4388-baec-2e87135dc908

What we can not do

  • Get the Owner role, or any access to the rest of your subscription.
  • Give any role to a person or a group.
  • See or change anything outside the one resource group.
  • Keep any access after you remove it.

Before you start

What your admin needs

  • The Owner role on the Azure subscription (Azure requires it to give access).
  • These resource providers registered in the subscription, once. Registering grants nobody access. The Azure form checks them and links to the page where you register any that are missing (Subscriptions → your subscription → Resource providers).
  • Microsoft.App
  • Microsoft.ContainerRegistry
  • Microsoft.DBforPostgreSQL
  • Microsoft.KeyVault
  • Microsoft.ManagedIdentity
  • Microsoft.OperationalInsights
  • Microsoft.Insights
  • Microsoft.Storage
  • Microsoft.Web
  • Microsoft.CognitiveServices

Revoke

Take it back at any time

In the Azure portal, open the resource group, then Access control (IAM) → Role assignments, and remove the two foundAItion build service assignments. Our access ends at once. Deleting the resource group removes the software and the access together.

Prefer to grant access by hand? Our team can walk your admin through a manual checklist instead. See also Trust & compliance.