# Configuring all Azure Resources

Below describes the complete configuration of all Azure components in the customer's Azure environment.

* [Azure App Service configuration](https://help.cumuluspro.net/straatos-archive/pages/DxsV5IY9Vjg6quFsl6Si#id-4.1-azure-app-service-configuration)
* [Azure Key Vault configuration](https://help.cumuluspro.net/straatos-archive/pages/DxsV5IY9Vjg6quFsl6Si#id-4.2-azure-key-vault-configuration)
* [Azure AI Search configuration](https://help.cumuluspro.net/straatos-archive/pages/DxsV5IY9Vjg6quFsl6Si#id-4.3-azure-ai-search-configuration)
* [Azure Storage Account configuration](https://help.cumuluspro.net/straatos-archive/pages/DxsV5IY9Vjg6quFsl6Si#id-4.4-azure-storage-account-configuration)
* [Azure Service Bus configuration](https://help.cumuluspro.net/straatos-archive/pages/DxsV5IY9Vjg6quFsl6Si#id-4.5-azure-service-bus-configuration)
* [API Management configuration](https://help.cumuluspro.net/straatos-archive/pages/DxsV5IY9Vjg6quFsl6Si#id-4.6-api-management-configuration)

***

### **Azure App Service configuration**

The full archive setup and configuration are performed within the Azure App Service. To proceed, you will need the deployment package file.

{% file src="/files/cV0YKfK33Po9DcI6ll60" %}

Once you have the file, follow these steps to complete the deployment.

1. Deploy the ZIP file to the Azure App Service by following the steps below.
2. Go to the settings of your Azure Web App. Under **Developer Tools** and open Advanced Tools.

<figure><img src="/files/nLoadhbAsgo47wN2mm7j" alt=""><figcaption></figcaption></figure>

3. Click on **Go** and a new web browser TAB will be opened.
4. Click Debug console > CMD.

<figure><img src="/files/GOZagjHko4QBhseC8ZiJ" alt=""><figcaption></figcaption></figure>

5. Go to directory (\home\site\wwwroot).

<figure><img src="/files/0N0ce3jJRFWh87WIJXlx" alt=""><figcaption></figcaption></figure>

6. In this directory (\home\site\wwwroot), the ZIP file should be deployed.
7. You can do this by Drag and Drop the ZIP file into this directory.

<figure><img src="/files/RBkrJS3w4rOyB5CFK9kJ" alt=""><figcaption></figcaption></figure>

8. The ZIP file will be automatically extracted into the wwwroot folder.
9. After the ZIP file is deployed you can edit / modify the appsettings.json file.
10. The purpose of this appsettings.json file is to configure the complete archive setup when there is no Key Vault available at the customer site.

{% hint style="info" %}
Please avoid configuring settings directly in appsettings.json file instead please utilize Key Vault or app service configuration, or both. Before deploying a new archive connector, ensure a backup of appsettings.json is created. If not using it, ensure all settings are commented.
{% endhint %}

#### Editing the app.settings JSON file

1. Please open the appsettings.json file.

<figure><img src="/files/FT4bs2lwENZCW1HvXKel" alt=""><figcaption></figcaption></figure>

2. Ensure the different sections are commented out by adding the underscore (\_) before each setting.

<figure><img src="/files/cEzYhKplDqfT38AYls8w" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
Do this for every section and key in the appsettings.json file.
{% endhint %}

#### Web App Configuration

1. Add a new configuration setting by clicking on **Settings** and **Environment Variables** then click on **Add**.

<figure><img src="/files/lERhlkLAtqFvkENw8bjA" alt=""><figcaption></figcaption></figure>

#### Create the following Web Application settings

**Application Setting for Database**

* Name: Database:CreateUpdateDatabase.
* Value: true.

<figure><img src="/files/qQYvwvEhFhZ3D0qWfshn" alt=""><figcaption></figcaption></figure>

**Application Setting for Keyvault**

* Name: KeyVault:Name.
* Value: keyvault-cpro-archive.

<figure><img src="/files/WBX7IOI9ZouMKUcSKylz" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
Please use your own created Key Vault name value.
{% endhint %}

**Application Setting for Storage Account**

* Name: StorageAccount:StorageName.
* Value: storagecproarchive.

<figure><img src="/files/SLFoxTr4G2llWs6cPEhL" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
Please use your own created storage account name value.
{% endhint %}

**Application Setting for Search Index URL**

* Name: SearchIndex:IndexUri.
* Value: <https://search-ai-cpro-archive.search.windows.net>.

<figure><img src="/files/KtYFXrWm8htWenWJFuTs" alt=""><figcaption></figcaption></figure>

The value of the SearchIndex:IndexUri can be found in the Azure AI Search.

<figure><img src="/files/NxPmdIenk90y7yJJLatR" alt=""><figcaption></figcaption></figure>

**Application Setting for Search Index Name**

The index will be created automatically upon the creation of the Azure AI Search.

* Name: SearchIndex:IndexName.
* Value: cprosearchindex.

<figure><img src="/files/vFw6PEP8qXg0rDlCeaZC" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
Please use your own created Index Name value.
{% endhint %}

#### Setting up Managed Identity on the Web App

To enable Managed Identity on the Web App:

1. In the **Settings** dropdown select **Identity**.
2. Set Status to On.
3. Click on **Save**.

<figure><img src="/files/Gv1470xFtUy2vgkToyOp" alt=""><figcaption></figcaption></figure>

Key Vault access always uses Managed Identity and below is a description of how to set up Azure role-based access control on the Azure Key Vault.

1. Select the Azure Key Vault and click on **Access configuration**.
2. Select **Azure role-based access control (recommended)**.

<figure><img src="/files/uBWOXfx2x1Dg6xeAuI0E" alt=""><figcaption></figcaption></figure>

3. Go to Access control (IAM) and click on Add > Add role assignment.

<figure><img src="/files/WvkfaXflhzOT7XHY9fh6" alt=""><figcaption></figcaption></figure>

4. Click on Job function roles and search for Key Vault Reader from the search bar. Select Key Vault Reader and click on the Next button.

<figure><img src="/files/5ZoDMvDUgJgAZO8pGjuO" alt=""><figcaption></figcaption></figure>

5. From the Members section, click on select members and a window on the right appears to select members. Search for the Azure Web App you have created.

<figure><img src="/files/GExII4jLGrC4EdBNNORN" alt=""><figcaption></figcaption></figure>

6. Click on **Review + assign** button.

<figure><img src="/files/Fvjb36NM0hmH0ECUulDp" alt=""><figcaption></figcaption></figure>

7. Repeat the Add role assignment for the role Key Vault Secret User.

<figure><img src="/files/E4jYQOTDbmmvb0uD4nAw" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/Wl8VcMjuEtdrFZSoYMVh" alt=""><figcaption></figcaption></figure>

#### Adding the database connection string to the Key Vault

{% hint style="info" %}
In order to create any secrets in the Key Vault. Please ensure that you have enough user rights.
{% endhint %}

* Name: ConnectionStrings—ArchiveContext.
* Secret value:
  * `Data Source=tcp:mydb.database.windows.net,1433;Initial Catalog=the-archive-catalog;User Id=mydbaccount;Password=verysecret`

<figure><img src="/files/WM6QqZD2LrIad4TrOkZ5" alt=""><figcaption></figcaption></figure>

The database user specified should have the following access rights on the database:

* DDL writer/reader access because it will create the database upon application startup.

If needed, these access rights can be revoked after the first successful startup.

***

### Azure AI Search configuration

Azure AI Search uses Managed Identity and below is a description of how to set up Azure role-based access control on the Azure AI Search.

1. Select the AI Search and go to Access Control (IAM) and click on Add > Add role assignment.

<figure><img src="/files/Wv4PBMk5qUoOXwRPq7Z8" alt=""><figcaption></figcaption></figure>

2. Add the role **Search Index Data Contributor**.

<figure><img src="/files/pvKFCu09ZifZIbnMtuI8" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/hP5JhNT4KeA9BzYgttaO" alt=""><figcaption></figcaption></figure>

3. Add the role **Contributor** role (under tab Privileged administrator roles).

<figure><img src="/files/0IX6OAEmAL9ollGE6yl9" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/T1UqXdLQ1BvcQv3dPhlC" alt=""><figcaption></figcaption></figure>

4. Change the **Keys** setting of the Cognitive Search resource.
5. In the search service, click on **Keys** and select **Role-based access control.**

<figure><img src="/files/EhqG9g4Plf09QHHozyqR" alt=""><figcaption></figcaption></figure>

***

### Azure Storage Account configuration

The Azure Storage Account is responsible for storing all documents in the archive. Therefore, the following settings must be applied:

1. Create a new container in the Storage Account (example: cparchive).

<figure><img src="/files/ZZmRz7wXyu6Z3XLmp61t" alt=""><figcaption></figcaption></figure>

2. Select the Web App and click on the **Configuration** and add a new application setting.

* Name: StorageAccount:ContainerName.
* Value: cparchive.

<figure><img src="/files/nnx6MkyAATMWzCdBd1fD" alt=""><figcaption></figcaption></figure>

3. The Azure Storage Accounts also work with Managed Identity, and you have to set the correct role rights so the Azure Web App can have access to the Azure Storage container you have just created.
4. Select the Storage account and go to Access Control (IAM) and click on **Add > Add role assignment.**

<figure><img src="/files/89utsUBZtyvRkCZUAC5y" alt=""><figcaption></figcaption></figure>

5. Add the role Storage Blob Data Contributor.

<figure><img src="/files/HrpZby5njPaTJjVABYwl" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/D8WSRahZwb5US8tHm7C5" alt=""><figcaption></figcaption></figure>

***

### Azure Service Bus configuration

{% hint style="info" %}
The Azure Service Bus will be configured in the CumulusPro Azure environment. CumulusPro Professional Services will take care of the settings below.
{% endhint %}

Create two new Queues in the Azure Service Bus. The **archive-result** is a mandatory queue and must have this name:

1. Select the Azure Service Bus and click on **Queues**.
2. Add a new Queue named **archive-result**.

<figure><img src="/files/zXlbMeNpEwLXkVfgUzfG" alt=""><figcaption></figcaption></figure>

3. Add another queue and you can use your own name.
4. Add a new Queue named archivecpro.

<figure><img src="/files/sM816KCerFpWGn40rahC" alt=""><figcaption></figcaption></figure>

The following queues are now created:

<figure><img src="/files/spyUTyOdt8DGYWyTBfQn" alt=""><figcaption></figcaption></figure>

5. Add the newly created Azure Servicebus queue to the Azure Web Application settings.
6. Select the Web App and click on the **Configuration** and add a new application setting.

* Name: ServiceBus:QueueName.
* Value: cparchivesetup.

<figure><img src="/files/S0CkLdxW7LxuL9V75Oot" alt=""><figcaption></figcaption></figure>

#### Service bus Shared Access Policy

Create a Share Access Policy on the service bus:

1. Select the Service Bus Namespace and click on the Shared access policies and add a New SAS Policy.
2. Add the access policies **Send** and **Listen**.

<figure><img src="/files/8gRIA40yjZlTsmsOfEOV" alt=""><figcaption></figcaption></figure>

Add the Primary Connection String to the Key Vault.

3. Click on sharedcpro to open the configuration.
4. Copy the Primary Connection String which is needed for the Key Vault setting.

<figure><img src="/files/g6YxSsYhodmlBAgsmLZd" alt=""><figcaption></figcaption></figure>

5. Select the Key Vault and click on the Secrets and add a new secret by clicking on Generate/Import.

<figure><img src="/files/3tfINE4H8Nu0pPaUKvvl" alt=""><figcaption></figcaption></figure>

6. Create a secret:

* Name: ServiceBus—ConnectionString.
* Secret value:&#x20;
  * The primary connection string you copied earlier.
* Example:
  * `Endpoint=sb://servicebuscproarchive.servicebus.windows.net/;SharedAccessKeyName=sharedcpro;SharedAccessKey=......`

<figure><img src="/files/wY9GIKEd1SYQtiXMMxb8" alt=""><figcaption></figcaption></figure>

7. You will now have the following secrets in Key Vault.

<figure><img src="/files/xIgFSTn2d4By0Amgnylq" alt=""><figcaption></figcaption></figure>

***

### API Management Configuration

If the Azure API Management is used, then the following API calls to the archive connector need to be configured.

The curl commands below do not include the body or the Authorization (Bearer Token).

Highlighted parts are parameters that change between calls:<br>

```
curl -X 'PUT' \
  'https://<your domain>/API/Document/<documentId>/SetLegalHold' \
  -H 'accept: */*'

curl -X 'PUT' \
  'https://<your domain>/API/Document/<documentId>/UnSetLegalHold' \
  -H 'accept: */*'

curl -X 'DELETE' \
  'https://<your domain>/API/Document/<documentId>/DeleteDocument' \
  -H 'accept: */*'

curl -X 'GET' \
  'https://<your domain>/API/File/<file>' \
  -H 'accept: */*'

curl -X 'GET' \
  'https://<your domain>/API/Index' \
  -H 'accept: application/json'

curl -X 'POST' \
  'https://<your domain>/API/Index/AddField' \
  -H 'accept: */*' \
  -H 'Content-Type: application/json-patch+json'

curl -X 'POST' \
  'https://<your domain>/API/Index/RemoveField' \
  -H 'accept: */*' \
  -H 'Content-Type: application/json-patch+json'

curl -X 'POST' \
  'https://<your domain>/API/Index/RemoveDocumentField' \
  -H 'accept: */*' \
  -H 'Content-Type: application/json-patch+json'

curl -X 'POST' \
  'https://<your domain>/API/Index/RebuildIndex' \
  -H 'accept: */*' \
  -H 'Content-Type: application/json-patch+json'

curl -X 'GET' \
  'https://<your domain>/API/Index/ListIndexes?definitionId=<definitionId>' \
  -H 'accept: application/json'

curl -X 'POST' \
  'https://<your domain>/API/Index/ActivateIndex?definitionId=<definitionId>' \
  -H 'accept: */*'

curl -X 'POST' \
  'https://<your domain>/API/Index/CancelRebuild' \
  -H 'accept: */*'

curl -X 'POST' \
  'https://<your domain>/API/Index/ResumeRebuild?definitionId=<definitionId>' \
  -H 'accept: */*'

curl -X 'GET' \
  'https://<yourdomain>/API/Index/IndexingLogs?limit=<limit>&order=<desc/asc>' \
  -H 'accept: application/json'

curl -X 'POST' \
  'https://<your domain>/API/Search' \
  -H 'accept: application/json' \
  -H 'Content-Type: application/json-patch+json'

```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://help.cumuluspro.net/straatos-archive/configuring-all-azure-resources.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.