# Azure & Entra Prerequisites - Quick Checklist

**Last Updated**: 2025-01-27  
**Purpose**: Quick reference checklist for Azure and Entra deployment prerequisites

---

## Azure Infrastructure Prerequisites

### Account & Subscription
- [ ] Azure subscription created
- [ ] Resource groups created (dev, stage, prod)
- [ ] Billing and cost management configured
- [ ] Azure Active Directory (Entra ID) tenant configured
- [ ] RBAC roles and permissions set up

### Prerequisites Setup (Run First)
- [ ] **Run Azure setup script**: `./infra/scripts/azure-setup.sh`
  - Lists all non-US Azure regions
  - Sets default region to West Europe
  - Checks and registers resource providers
  - Checks quotas
- [ ] **Register resource providers**: `./infra/scripts/azure-register-providers.sh`
  - Registers all 13 required resource providers
  - Verifies registration status
- [ ] **Check quotas**: `./infra/scripts/azure-check-quotas.sh`
  - Reviews quota limits for all regions
  - Identifies any quota constraints

### Terraform Configuration
- [x] Azure provider (`azurerm`) configured in `infra/terraform/main.tf`
  - ✅ **COMPLETED** - Default region: `westeurope` (no US regions)
  - ✅ Provider version: `~> 3.0`
  - ✅ Region validation prevents US regions
- [ ] Azure Storage Account for Terraform state backend
  - Action: Create Storage Account, then uncomment backend block
- [ ] Azure resources defined:
  - [ ] AKS cluster
  - [ ] Azure Database for PostgreSQL
  - [ ] Azure Storage Account
  - [ ] Azure Key Vault
  - [ ] Azure Container Registry (ACR)
  - [ ] Application Gateway / Load Balancer
  - [ ] Virtual Network and subnets

### Required Resource Providers (13 total)
See `infra/terraform/AZURE_RESOURCE_PROVIDERS.md` for details.

- [ ] Microsoft.ContainerService (AKS)
- [ ] Microsoft.KeyVault
- [ ] Microsoft.Storage
- [ ] Microsoft.Network
- [ ] Microsoft.Compute
- [ ] Microsoft.DBforPostgreSQL
- [ ] Microsoft.ContainerRegistry
- [ ] Microsoft.ManagedIdentity
- [ ] Microsoft.Insights
- [ ] Microsoft.Logic
- [ ] Microsoft.OperationalInsights
- [ ] Microsoft.Authorization
- [ ] Microsoft.Resources

**Quick Register**: Run `./infra/scripts/azure-register-providers.sh`

### Kubernetes (AKS)
- [ ] AKS cluster deployed
- [ ] Azure CNI networking configured
- [ ] Azure Disk CSI driver configured
- [ ] Azure Key Vault Provider for Secrets Store CSI configured
- [ ] Azure Container Registry integration configured
- [ ] Azure Monitor for containers configured
- [ ] Azure Log Analytics workspace configured

### Secrets Management
- [ ] Azure Key Vault instances created (dev, stage, prod)
- [ ] External Secrets Operator configured for Azure Key Vault
- [ ] Azure Managed Identities created for services
- [ ] Secrets migrated to Azure Key Vault

### Networking & Security
- [ ] Virtual Network with subnets configured
- [ ] Network Security Groups (NSGs) configured
- [ ] Azure Firewall or WAF rules configured
- [ ] Azure Private Link configured (if needed)
- [ ] DNS zones and records configured

### Monitoring
- [ ] Azure Monitor and Application Insights configured
- [ ] Azure Log Analytics workspaces configured
- [ ] Azure Alert Rules configured
- [ ] Azure Dashboards configured

### CI/CD
- [ ] Azure DevOps or GitHub Actions configured for Azure
- [ ] Azure Container Registry build pipelines configured
- [ ] Azure deployment pipelines configured
- [ ] Azure service connections and service principals configured

**Estimated Effort**: 4-6 weeks

---

## Microsoft Entra ID Prerequisites

### App Registration
- [ ] Azure AD App Registration created
  - [ ] Application (client) ID noted
  - [ ] Directory (tenant) ID noted
- [ ] API Permissions configured:
  - [ ] `Verifiable Credentials Service - VerifiableCredential.Create.All`
  - [ ] `Verifiable Credentials Service - VerifiableCredential.Verify.All`
  - [ ] Admin consent granted
- [ ] Client Secret created and securely stored
- [ ] Redirect URIs configured for OAuth/OIDC flows

### Verified ID Service
- [ ] Verified ID service enabled in Azure Portal
- [ ] Credential Manifest created
  - [ ] Manifest ID noted
  - [ ] Credential type definitions configured
  - [ ] Claims schema defined
- [ ] Issuer DID verified: `did:web:{tenant-id}.verifiedid.msidentity.com`

### Azure Logic Apps (Optional)
- [ ] Logic App workflows created:
  - [ ] eIDAS verification workflow
  - [ ] VC issuance workflow
  - [ ] Document processing workflow
- [ ] Workflow URLs obtained
- [ ] Access keys generated or managed identity configured
- [ ] Managed Identity permissions granted (if using)

**Estimated Effort**: 1-2 days (without Logic Apps), 1-2 weeks (with Logic Apps)

---

## Environment Variables Configuration

### Required for Entra VerifiedID
```bash
ENTRA_TENANT_ID=<tenant-id>
ENTRA_CLIENT_ID=<client-id>
ENTRA_CLIENT_SECRET=<client-secret>
ENTRA_CREDENTIAL_MANIFEST_ID=<manifest-id>
```

### Optional for Azure Logic Apps
```bash
AZURE_LOGIC_APPS_WORKFLOW_URL=<workflow-url>
AZURE_LOGIC_APPS_ACCESS_KEY=<access-key>
AZURE_LOGIC_APPS_MANAGED_IDENTITY_CLIENT_ID=<managed-identity-id>
```

### Required for Azure Key Vault
```bash
AZURE_KEY_VAULT_URL=<key-vault-url>
AZURE_TENANT_ID=<tenant-id>
AZURE_CLIENT_ID=<client-id>
AZURE_CLIENT_SECRET=<client-secret>
AZURE_MANAGED_IDENTITY_CLIENT_ID=<managed-identity-id>
```

**Status**: Schema exists in `packages/shared/src/env.ts`, values need to be configured.

---

## Quick Start Guide

### Step 1: Azure Account Setup (Day 1)
1. Create Azure subscription
2. Create resource groups (dev, stage, prod)
3. Configure Azure AD/Entra ID tenant
4. **Run setup scripts**:
   ```bash
   # Complete setup (regions, providers, quotas)
   ./infra/scripts/azure-setup.sh
   
   # Or run individually:
   ./infra/scripts/azure-register-providers.sh
   ./infra/scripts/azure-check-quotas.sh
   ```

### Step 2: Entra ID App Registration (Day 1-2)
1. Go to Azure Portal → Azure Active Directory → App registrations
2. Create new registration
3. Note Application (client) ID and Directory (tenant) ID
4. Configure API permissions and grant admin consent
5. Create client secret

### Step 3: Verified ID Setup (Day 2)
1. Go to Azure Portal → Verified ID
2. Enable service
3. Create credential manifest
4. Note Manifest ID

### Step 4: Azure Infrastructure (Weeks 1-6)
1. Configure Terraform Azure provider
2. Define Azure resources
3. Deploy AKS cluster
4. Set up Key Vault
5. Configure networking
6. Set up monitoring

### Step 5: Environment Configuration (Week 6-7)
1. Configure all environment variables
2. Store secrets in Azure Key Vault
3. Test connectivity

### Step 6: Deployment (Week 7-8)
1. Build and push container images
2. Deploy services to AKS
3. Configure ingress
4. Test end-to-end

---

## Verification Steps

### Verify Entra ID Setup
```bash
# Test Entra VerifiedID connection
curl -X POST https://your-api/vc/issue/entra \
  -H "Content-Type: application/json" \
  -d '{"claims": {"email": "test@example.com"}}'
```

### Verify Azure Infrastructure
```bash
# Check AKS cluster
az aks list --resource-group the-order-dev

# Check Key Vault
az keyvault list --resource-group the-order-dev

# Check Container Registry
az acr list --resource-group the-order-dev
```

### Verify Kubernetes Deployment
```bash
# Check pods
kubectl get pods -n the-order-dev

# Check services
kubectl get services -n the-order-dev

# Check ingress
kubectl get ingress -n the-order-dev
```

---

## Documentation References

- **Full Review**: `docs/reports/DEPLOYMENT_READINESS_REVIEW.md`
- **Entra Integration Guide**: `docs/integrations/MICROSOFT_ENTRA_VERIFIEDID.md`
- **Resource Providers**: `infra/terraform/AZURE_RESOURCE_PROVIDERS.md`
- **Setup Scripts**: `infra/scripts/README.md`
- **Infrastructure README**: `infra/README.md`
- **Terraform README**: `infra/terraform/README.md`
- **Kubernetes README**: `infra/k8s/README.md`

---

## Support & Troubleshooting

### Common Issues

1. **"Failed to get access token"**
   - Check tenant ID, client ID, and client secret
   - Verify API permissions are granted
   - Check admin consent is provided

2. **"Credential manifest ID is required"**
   - Ensure `ENTRA_CREDENTIAL_MANIFEST_ID` is set
   - Verify manifest exists in Azure Portal

3. **Terraform Azure provider errors**
   - Verify Azure credentials are configured
   - Check subscription permissions
   - Verify resource group exists

4. **AKS deployment failures**
   - Check node pool configuration
   - Verify network connectivity
   - Check service principal permissions

---

**Next Action**: Start with Azure account setup and Entra ID App Registration (can be done in parallel).

