CET2 — Deploy to Azure

This repository contains only the Azure infrastructure template for CET2 (Clefsoft Endpoint Toolkit 2) — it exists so the Deploy to Azure button can fetch a template publicly. The CET2 application source is maintained in a separate, private repository.

What main.bicep (compiled to azuredeploy.json) provisions

• App Service (Linux, .NET 10) with a System-assigned Managed Identity
• Key Vault to hold the Graph certificate, with the App Service's identity granted Key Vault Secrets User
• Application Insights
• App settings pre-wired for AzureAd:* and Cet2:* configuration

What it deliberately does not do

Not automated	Why	Instead
Creating the two Entra app registrations	ARM cannot create Entra objects — that's a Microsoft Graph operation	Create them first — see the Deployment Guide
Uploading the Graph certificate	Keeps the private key out of any deployment template or its history	Upload it to the Key Vault this template creates, once deployment completes
Deploying the application binary	This template provisions empty compute	Deployed separately via CI/CD, once the infrastructure exists

Parameters

Parameter	Required	Notes
namePrefix	Yes	Globally-unique prefix for resource names, e.g. cet2-contoso
brandName	No	The product name shown in the portal (sign-in screen, sidebar, tab title). Defaults to ClefSoft Endpoint Toolkit; set it to white-label the deployment, e.g. Getronics Endpoint Toolkit — no rebuild needed, this is a runtime setting
location	No	Defaults to the resource group's region
appServiceSku	No	F1 / B1 (default) / B2 / S1
portalClientId	Yes	The Portal app registration's client ID
dataClientId	Yes	The Data app registration's client ID
homeTenantId	Yes	The MSP/home Entra tenant ID
graphCertificateName	No	Key Vault secret name for the certificate (default cet2-graph-cert)
bootstrapAdminObjectId	Yes	Entra object ID to seed as the first Platform Super Administrator
deploymentMode	No	Msp (default) or CustomerOwned

Full documentation

See docs.clefsoft.co.uk/deployment for the complete, correctly-ordered deployment guide.

Rebuilding azuredeploy.json after editing main.bicep

az bicep build --file main.bicep --outfile azuredeploy.json

Commit both files together — the Deploy to Azure button reads azuredeploy.json directly from this repository, not the Bicep source.