Last Updated: February 2026
Important: AURA is a self-hosted solution. All data remains within the customer's Azure environment.
Deployment Type: Azure Web App (Linux, Node.js 20) with Next.js Standalone Build

Prerequisites
Create Azure Resource Group
Setup Azure SQL Server & Database
Azure AD App Registration
Microsoft Graph API Permissions
Create & Configure Azure Web App
Setup Custom Domain (Optional)
Configure GitHub Repository & CI/CD
Deploy Database Schema
Perform First Deployment
First Steps After Deployment
All Environment Variables (Reference)
Troubleshooting

1. Prerequisites

Required Access

Azure Subscription with Owner or Contributor rights
Azure AD (Entra ID) with Global Administrator or Application Administrator role
GitHub Account with the repository for the AURA code

Required Software (for local testing)

Architecture Overview

┌─────────────────────────────┐
│  Azure Web App (Linux)      │ ← Next.js Standalone (Node.js 20)
│  - Frontend & API           │
│  - NextAuth (Azure AD OAuth)│
└────────────┬────────────────┘
             │
┌────────────▼────────────────┐
│  Azure SQL Database         │ ← Prisma ORM (SQL Server Provider)
│  - Users, Subscriptions     │
│  - Reports, Activation Keys │
│  - Audit Logs               │
└─────────────────────────────┘
             │
┌────────────▼────────────────┐
│  Microsoft Graph API        │ ← Delegated Permissions (User Context)
│  - Tenant Data Collection   │
│  - 28 Report Categories     │
└─────────────────────────────┘

2. Create Azure Resource Group

Go to https://portal.azure.com
Search for "Resource groups"
Click "+ Create"
Configure:
- Subscription: Select your subscription
- Resource group: rg-aura-production
- Region: West Europe (or nearest region)
Click "Review + create" → "Create"

3. Setup Azure SQL Server & Database

3.1 Create SQL Server

Search for "SQL servers"
Click "+ Create"
Configure Basics:
- Resource group: rg-aura-production
- Server name: sql-aura-[companyname] (must be globally unique)
- Location: West Europe
- Authentication method: Use SQL authentication
- Server admin login: auraadmin
- Password: A secure password (write this down!)
"Review + create" → "Create" (approx. 2 minutes)

3.2 Create Database

Open the created SQL Server resource.
Click "SQL databases" on the left → "+ Create database"
Configure:
- Database name: aura-db
- Want to use SQL elastic pool? No
- Workload environment: Production
Under "Compute + Storage" → "Configure database":
- Service tier: Basic (scalable later)
- Data max size: 2 GB
- Click "Apply"
"Review + create" → "Create"

3.3 Configure Firewall

Go back to the SQL Server resource.
Click "Networking" on the left.
Under "Firewall rules":
- Set "Allow Azure services and resources to access this server" to "Yes"
- Optional: Add your own IP for local testing.
Click "Save"

3.4 Construct Connection String

The DATABASE_URL for Prisma has the following format:

sqlserver://sql-aura-[companyname].database.windows.net:1433;database=aura-db;user=auraadmin;password=YOUR_PASSWORD;encrypt=true;trustServerCertificate=false

Important: Special characters in the password must be URL-encoded (e.g., @ → %40, # → %23).

4. Azure AD App Registration

4.1 Create App Registration

Search for "App registrations"
Click "+ New registration"
Configure:
- Name: AURA SaaS
- Supported account types: Accounts in this organizational directory only (Single Tenant)
- Redirect URI:
  - Type: Web
  - URI: http://localhost:3000/api/auth/callback/azure-ad (Development)
Click "Register"

4.2 Note Important IDs

On the Overview page of the App Registration:

Value	Used As
Application (client) ID	`AZURE_AD_CLIENT_ID`
Directory (tenant) ID	`AZURE_AD_TENANT_ID`

4.3 Create Client Secret

Left menu → "Certificates & secrets"
"Client secrets" → "+ New client secret"
Configure:
- Description: AURA Production
- Expires: 24 months
Click "Add"
Copy the Value IMMEDIATELY (it is only shown once!) → AZURE_AD_CLIENT_SECRET

4.4 Configure Redirect URIs

Left menu → "Authentication"

Under "Web" → "Redirect URIs", add ALL required URIs:

http://localhost:3000/api/auth/callback/azure-ad
https://YOUR-WEBAPP-URL.azurewebsites.net/api/auth/callback/azure-ad
https://your-custom-domain.com/api/auth/callback/azure-ad

Important: The Redirect URI must match the NEXTAUTH_URL EXACTLY. If you use a custom domain, the Redirect URI must contain the custom domain.

Under "Implicit grant and hybrid flows":
- Enable "ID tokens"
Click "Save"

5. Microsoft Graph API Permissions

5.1 Basic Permissions (Mandatory)

These permissions are minimally required for login and basic functionality:

Go to App Registration → "API permissions"
"+ Add a permission" → "Microsoft Graph" → "Delegated permissions"
Add the following permissions:

Permission	Type	Required For
`openid`	Delegated	OAuth Login
`profile`	Delegated	User Profile
`email`	Delegated	Email Address
`User.Read`	Delegated	Read Own Profile
`Directory.Read.All`	Delegated	Entra ID Users & Groups

5.2 Report Permissions (Depending on Report Type)

Each report category requires specific permissions. Only add the permissions you need:

Report Category	Permission	Type	Description
Entra ID	`User.Read.All`	Delegated	Read all users
Entra ID	`Group.Read.All`	Delegated	Read all groups
Entra ID	`Application.Read.All`	Delegated	Read app registrations
Organization	`Organization.Read.All`	Delegated	Org info
Exchange Online	`User.Read.All`	Delegated	Mailbox detection
Teams	`Team.ReadBasic.All`	Delegated	List Teams
Intune	`DeviceManagementConfiguration.Read.All`	Delegated	Device configurations
Intune	`DeviceManagementManagedDevices.Read.All`	Delegated	Managed devices
SharePoint	`Sites.Read.All`	Delegated	SharePoint sites
SharePoint Settings	`SharePoint.ReadWrite.All`	Delegated	Tenant settings (Beta)
Conditional Access	`Policy.Read.All`	Delegated	CA policies
Purview	`InformationProtection.Read.All`	Delegated	Sensitivity Labels
Modern Auth	`Policy.Read.All`	Delegated	Auth policies
Defender	`SecurityEvents.Read.All`	Delegated	Security alerts
Reports / Adoption	`Reports.Read.All`	Delegated	Usage Reports
Bookings	`Bookings.Read.All`	Delegated	Booking pages
Brand Center	`OrganizationBranding.Read.All`	Delegated	Branding settings
M365 Groups	`Group.Read.All`	Delegated	Group types & settings

`User.Read`	Application	User
`Directory.Read.All`	Application	Directory
`Group.Read.All`	Application	Group
`Team.ReadBasic.All`	Application	Team
`Sites.Read.All`	Application	Sites
`DeviceManagementConfiguration.Read.All`	Application	DeviceManagementConfiguration
`Policy.Read.All`	Application	Policy
`SecurityEvents.Read.All`	Application	SecurityEvents
`Reports.Read.All`	Application	Reports
`Organization.Read.All`	Application	Organization
`User.Read.All, Group.Read.All, Directory.Read.All, Application.Read.All`	Application	Identity & Users
`Organization.Read.All, Domain.Read.All`	Application	Organization
`DeviceManagementConfiguration.Read.All, DeviceManagementManagedDevices.Read.All`	Application	Intune / Devices
`MailboxSettings.Read, Mail.ReadBasic.All`	Application	Exchange / Mail
`Team.ReadBasic.All, Channel.ReadBasic.All, Group.Read.All`	Application	Teams & Planner
`SecurityEvents.Read.All, SecurityAlert.Read.All`	Application	Security / Defender
`Sites.Read.All, AppCatalog.Read.All`	Application	SharePoint / Apps
`InformationProtectionPolicy.Read.All, Policy.Read.ConditionalAccess`	Application	Governance / Purview
`Reports.Read.All`	Application	Reports / Adoption
`Reports.Read.All, Analytics.Read`	Application	Microsoft Viva
`InformationProtectionPolicy.Read.All`	Application	InformationProtectionPolicy

5.3 Optional API Permissions (Advanced Reports)

Power Platform Admin API

For: Environments, Power Apps, Power Automate Flows, DLP Policies

"+ Add a permission" → "APIs my organization uses"
Search: "PowerApps Service"
Add: User (Application permission)
In the App Settings: Set POWER_PLATFORM_ENABLED=true

Microsoft 365 Defender API

For: Defender for Endpoint (Machines, Vulnerabilities, Alerts, Incidents)

"+ Add a permission" → "APIs my organization uses"
Search: "WindowsDefenderATP"
Add Application Permissions:
- Machine.Read.All
- Alert.Read.All
- Vulnerability.Read.All
In the App Settings: Set DEFENDER_API_ENABLED=true

5.4 Grant Admin Consent

IMPORTANT: After adding all permissions:

Click "Grant admin consent for [Your Organization]"
Confirm with "Yes"
All permissions should now have a green checkmark (✅).

Without Admin Consent, reports for the respective areas will be empty.

6. Create & Configure Azure Web App

6.1 Create Web App

Search for "App Services"
Click "+ Create" → "Web App"
Configure Basics:
- Resource group: rg-aura-production
- Name: aura-saas-app (becomes aura-saas-app.azurewebsites.net)
- Publish: Code
- Runtime stack: Node 20 LTS
- Operating System: Linux
- Region: West Europe
- Pricing plan: Basic B1 (Minimum for Production)
"Review + create" → "Create"

6.2 Configure Startup Command

Open the Web App resource.
Left menu → "Configuration" → "General settings"
Startup Command: node server.js
"Save"

Important: Without this Startup Command, Azure attempts to use the Oryx build process, which will fail for the standalone build.

6.3 Configure Environment Variables

Left menu → "Configuration" → "Application settings"
Click "+ New application setting" for each variable:

Mandatory Variables

Name	Value	Description
`DATABASE_URL`	`sqlserver://...`	Prisma Connection String (see 3.4)
`AZURE_AD_CLIENT_ID`	`xxxxxxxx-xxxx-...`	App Registration Client ID
`AZURE_AD_CLIENT_SECRET`	`xxxxx~xxxxx...`	App Registration Secret
`AZURE_AD_TENANT_ID`	`xxxxxxxx-xxxx-...`	Azure Tenant ID
`NEXTAUTH_SECRET`	(32+ chars)	Session Encryption*
`NEXTAUTH_URL`	`https://aura.azurewebsites.net`	Full App URL**
`ADMIN_PASSWORD`	(min. 8 chars)	Password for SaaS Admin Area

* Generate with: openssl rand -base64 32

** IMPORTANT: If using a Custom Domain, NEXTAUTH_URL must be the custom domain (e.g., https://aura.mycompany.com), NOT the .azurewebsites.net URL!

7. Setup Custom Domain (Optional)

7.1 Add Custom Domain

Web App → "Custom domains"
"+ Add custom domain"
Enter domain (e.g., aura.mycompany.com)
Configure DNS records according to instructions:
- CNAME: aura → aura-saas-app.azurewebsites.net
- Or A-Record + TXT-Validation
SSL Certificate: "App Service Managed Certificate" (Free)

7.2 Update NEXTAUTH_URL

CRITICAL: After setting up the Custom Domain:

Web App → "Configuration" → "Application settings"
Change NEXTAUTH_URL to: https://aura.mycompany.com
"Save"

7.3 Update Redirect URI in App Registration

Go to App Registration → "Authentication"
Add Redirect URI: https://aura.mycompany.com/api/auth/callback/azure-ad
"Save"

Warning: NEXTAUTH_URL and the Redirect URI must ALWAYS use the same domain! If users access via custom domain but NEXTAUTH_URL points to Azure URL, OAuth login will fail ("State cookie was missing").

8. Configure GitHub Repository & CI/CD

8.1 Download Publish Profile

Web App → "Overview" → "Download publish profile"
Open the downloaded .PublishSettings file in a text editor.
Copy the entire content of the file.

8.2 Configure GitHub Secrets

GitHub Repository → "Settings" → "Secrets and variables" → "Actions"
"New repository secret" for each entry:

Secret Name	Value
`AZURE_WEBAPP_PUBLISH_PROFILE`	Entire content of `.PublishSettings` file
`DATABASE_URL`	Prisma Connection String (for Migrations)

8.3 Create GitHub Environment

"Settings" → "Environments"
"New environment" → Name: Production
"Configure environment"

8.4 Check Workflow File

Ensure .github/workflows/azure-static-web-apps.yml is configured correctly:

env:
  AZURE_WEBAPP_NAME: 'aura-saas-app'  # ← Adjust to your Web App Name!
  NODE_VERSION: '20.x'

9. Deploy Database Schema

Option A: Via GitHub Actions (Recommended)

GitHub Repository → "Actions"
Left: "Database Migration" Workflow
Click "Run workflow"
Configure:
- Environment: production
- Action: push (creates/updates all tables)
"Run workflow"

Option B: Locally

# Set DATABASE_URL as environment variable
export DATABASE_URL="sqlserver://sql-aura-xxx..."

# Push schema to database (creates all 10 tables)
npx prisma db push

10. Perform First Deployment

10.1 Pre-Flight Checklist

Azure Resource Group created
Azure SQL Server + Database created
Firewall: "Allow Azure services" enabled
App Registration created with Client ID, Secret, Tenant ID
Redirect URIs configured (localhost + production URL)
Graph API Permissions added + Admin Consent granted
Azure Web App created
Startup Command: node server.js
All Environment Variables configured
GitHub Secrets configured (Publish Profile + DATABASE_URL)
AZURE_WEBAPP_NAME in Workflow file updated
Database Schema deployed (prisma db push)

10.2 Trigger Deployment

git add .
git commit -m "AURA deployment"
git push origin main

10.3 Verify Deployment

GitHub → "Actions" → Wait for green tick (~5 Min)
Open Web App URL in browser
Test Health Endpoint: https://YOUR-URL/api/health
- Should return JSON with status: "healthy" and list of all 10 tables.

11. First Steps After Deployment

11.1 Test Admin Panel

Go to https://YOUR-URL/rootadmin
Enter ADMIN_PASSWORD
Create an Activation Key:
- Plan: PROFESSIONAL or ENTERPRISE
- Duration: 365 Days
- Permissions: Select all desired report types

11.2 Test Microsoft 365 Login

Go to Home Page.
Click "Login with Microsoft 365".
Login with a user from your tenant.

11.3 Activate Subscription

Go to "Subscriptions" in Dashboard.
Enter the created Activation Key.

12. All Environment Variables (Reference)

Variable	Format	Example
`DATABASE_URL`	Prisma SQL Server String	`sqlserver://server...`
`AZURE_AD_CLIENT_ID`	UUID	`12345678-1234...`
`AZURE_AD_CLIENT_SECRET`	String	`Xxx8Q~xxxxx`
`AZURE_AD_TENANT_ID`	UUID	`12345678-1234...`
`NEXTAUTH_SECRET`	String (min. 32 chars)	`K7xYz...`
`NEXTAUTH_URL`	HTTPS URL	`https://aura.mycompany.com`
`ADMIN_PASSWORD`	String	Secure Password
`POWER_PLATFORM_ENABLED`	true / false	`false`
`DEFENDER_API_ENABLED`	true / false	`false`

13. Troubleshooting

Login: "error=Callback" / "State cookie was missing"

Cause: NEXTAUTH_URL does not match the URL used to access the app.

Solution: Ensure NEXTAUTH_URL, the Redirect URI in App Registration, and the browser URL are identical (do not mix .azurewebsites.net and Custom Domains).

Report area is empty / "No data available"

Cause: Missing API permissions or Admin Consent.

Solution: Add the specific permission (see section 5.2) and Grant Admin Consent.

Database Connection Failed

Check SQL Server Firewall: "Allow Azure services" must be Yes.
Check Password for special characters (URL encoding required).

GitHub Action Fails

Check AZURE_WEBAPP_PUBLISH_PROFILE secret (must contain full file content).
Check if AZURE_WEBAPP_NAME in YAML matches the Azure resource name.

AURA — Self-Hosted Microsoft 365 Tenant Documentation Solution
All data remains within the customer's Azure environment.

Table of Contents