Skip to main content

Azure Deployment FAQ

This FAQ answers common questions for customer-managed (BYOC) Azure deployments of Digital Twin.

1) Do you support Azure BYOC deployments?​

Yes. Digital Twin can run in your Azure environment so customer data and logs stay within your cloud boundary.

2) What should we provide before Azure deployment starts?​

Most deployments require:

  • A dedicated Azure subscription
  • Required RBAC access for deployment identities
  • Target region and networking details
  • Domain and DNS ownership information

Some customers also pre-provision core networking or platform resources based on their internal cloud standards.

3) What Azure RBAC access is required?​

Viven typically needs permissions equivalent to:

  • Contributor
  • User Access Administrator (or equivalent role-assignment permissions)

Access scope is defined during onboarding based on your governance model.

4) What AKS sizing is required?​

AKS sizing is workload-dependent.
Most production environments use multiple node pools (for example, app workloads, search/indexing workloads, and background processing) with autoscaling where appropriate.

5) How are private endpoints and DNS handled?​

Private endpoint and private DNS ownership is defined during kickoff.
Some customers manage both directly; in other cases, responsibilities are split between customer and Viven teams.

6) What quota and region checks are needed before deployment?​

Validate subscription quotas and service availability in your target region before deployment starts.
This is a common source of delays, especially for compute and managed database services.

7) Which Azure OpenAI models should be validated?​

Confirm required model availability and quota in your target region for your planned use cases (for example, chat, embeddings, transcription, or realtime experiences).

Current OpenAI models:

Model Name
gpt-4o-2024-11-20
gpt-4.1-2025-04-14
gpt-4.1-mini-2025-04-14
gpt-4.1-nano-2025-04-14
gpt-5-2025-08-07
gpt-5-mini-2025-08-07
gpt-5-nano-2025-08-07
gpt-5.2-2025-12-11
gpt-5.4-2026-03-05
gpt-4o-mini-2024-07-18
gpt-4o-transcribe
gpt-realtime-1.5
whisper-1
text-embedding-3-large
o3

8) How does deployment work after infrastructure is ready?​

After infrastructure is provisioned, deployment runs through an automated, identity-based flow:

  1. A release is approved and published for your environment.
  2. The deployment runner authenticates using OIDC federation (workload identity), so access is granted through short-lived tokens instead of long-lived static credentials.
  3. Using that trusted identity path, the runner retrieves the approved release artifacts and deploys them to the target Azure services.
  4. Post-deploy checks run, and deployment status is reported back for operational visibility.

This OIDC model helps reduce credential-management risk while keeping deployment access controlled and auditable.

9) How are logs and monitoring handled in Azure BYOC?​

Monitoring typically uses Azure Monitor and Log Analytics.
Depending on your policy, logs can also be archived to long-term storage for compliance and retention.

10) What network and security questions should we confirm early?​

Confirm:

  • Proxy/firewall and outbound access rules
  • TLS/certificate requirements
  • DNS zone ownership
  • Private endpoint ownership and process
  • Any public endpoint allowlisting requirements