SecondStack pilot - prerequisites

1. portal.azure.com → Virtual machines → Create → Azure virtual machine.
2. Image: Ubuntu Server 24.04 LTS - x64 Gen2. Size: Standard_D8s_v5.
3. Authentication type: SSH public key. SSH public key source: Use existing public key, and paste our key from the last item below.
4. Disks tab: OS disk size 256 GiB, type Premium SSD.
5. Networking tab: Public IP → Create new, assignment Static.
6. Review + create. Then copy the Public IP address from the VM's Overview page.

1. EC2 console → Key pairs → Actions → Import key pair. Paste our key from the last item below.
2. Instances → Launch instances.
3. AMI: Ubuntu Server 24.04 LTS, 64-bit (x86). Instance type: m7i.2xlarge.
4. Key pair: the one you imported.
5. Configure storage: 256 GiB, gp3.
6. Launch instance.
7. Elastic IPs → Allocate Elastic IP address, then Actions → Associate with the instance. Copy that address.

1. Order a VM with the size, image and disk from the table above.
2. Make sure it has a public IPv4 address that does not change.
3. If the provider asks for an SSH key, paste our key from the last item below.

1. Open the VM → Networking → Network settings → Create port rule → Inbound port rule.
2. Rule 1: Source Any, Service HTTPS, Action Allow.
3. Rule 2: Source Any, Service HTTP, Action Allow.
4. Rule 3: Source IP Addresses with our address, Service SSH, Action Allow.
5. If Azure already made an SSH rule open to Any, delete it.

1. Open the instance → Security tab → its security group → Edit inbound rules.
2. Rule 1: Type HTTPS, Source Anywhere-IPv4.
3. Rule 2: Type HTTP, Source Anywhere-IPv4.
4. Rule 3: Type SSH, Source Custom with our address.
5. Delete any other inbound rule, then Save rules.

1. Set these rules in your provider's firewall.
2. If the provider has no firewall, skip this. We set one up on the VM during the install.

This depends on where the domain is hosted (Azure DNS, Cloudflare, GoDaddy, Route 53 and so on). In general:

1. Open the DNS zone of your company domain.
2. Add a record of type A. Name: the portal hostname. Value: the VM public IP.
3. Add a second A record. Name: the same hostname with *. in front. Value: the same IP.
4. Most providers want the name without the company domain, for example ai-portal and *.ai-portal.
5. If the provider offers a proxy option (the orange cloud in Cloudflare), turn it off for both records.

1. Open entra.microsoft.com → App registrations → New registration.
2. Name: anything, for example AI Portal.
3. Supported account types: Accounts in this organizational directory only.
4. Redirect URI: platform Web, with this value:
   Copy
5. Select Register. On the Overview page, copy the Application (client) ID and the Directory (tenant) ID.

1. In the app: Certificates & secrets → New client secret.
2. Pick the longest expiry your policy allows, then Add.
3. Copy the Value column now. Entra shows it only once.

1. In the app: App roles → Create app role.
2. Display name User, allowed member types Users/Groups, value User, any description. Apply.
3. Repeat with Admin.

1. In the app: Token configuration → Add optional claim.
2. Token type ID, tick acct, Add.

1. In the app: API permissions → Add a permission → Microsoft Graph → Application permissions.
2. Add these five:
   • Application.Read.All
   • Group.Read.All
   • GroupMember.Read.All
   • User.Read.All
   • User.EnableDisableAccount.All
3. Select Grant admin consent. This needs a Global Administrator or Privileged Role Administrator.

1. Open Enterprise applications and select the same app.
2. Properties → set Assignment required? to Yes → Save.
3. Users and groups → Add user/group. Select the pilot users or a group, with the role User.
4. Do the same for the platform admins, with the role Admin.