Skip to main content

Running Your Deployment

How a deployment we operate in your Azure runs once it is live. Everything your team does to get there is in the Setup Guide.

Updates​

Updates are deployed by our team via automated CI/CD. The process:

  1. We choose the release for your environment and notify you
  2. Our CI/CD pipeline builds it and deploys it to your Container App
  3. Azure Container Apps starts the new version before it stops the old one: with two or more replicas, users see no downtime; with one replica (the usual test setup), a brief interruption
  4. We notify you when the update is done

Production updates go out in the change window you set. Only application code is updated. Your data, configuration, and infrastructure remain unchanged.

Settings You Manage​

With the environment's admin key and the da command-line tool (System Administration) you change, at any time and without a redeploy:

API keys for integrations are managed by tenant administrators on the application's Integrations page.

Security​

  • The service principal has access only to the DocAI Fabric subscription (and, if your network lives in another subscription, to the subnets you granted it)
  • OIDC federation means no long-lived secrets are stored in our CI/CD system
  • Blob Storage uses managed identity (no storage keys in application config)
  • All application secrets are stored in your Key Vault instance
  • Every deployment is recorded in your Azure Activity Log; our pipeline's own run logs are available on request
  • You can revoke access at any time by deleting the service principal. This does not affect our read-only log access, which is a separate delegation (Application Logs)

FAQ​

Can I monitor the application myself?​

Yes. Application Insights and Log Analytics are deployed in your resource group. You have full access to logs, metrics, and alerts in the Azure Portal. See Application Logs.

What happens if I revoke the service principal?​

We lose the ability to deploy updates. The application continues to run with the last deployed version. You can re-grant access at any time by creating a new service principal.

Can I use my existing Azure OpenAI deployment?​

Yes. A tenant administrator adds it on the Models page, with its endpoint and key; several endpoints for one model are load-balanced. The application reaches it from your network, so the deployment needs a private endpoint the application subnet can reach, or an outbound firewall rule to its public endpoint.