# Manual deployment

{% hint style="warning" %}
The deployment steps detailed below are intended for **manual/local deployment via Bicep**. The steps for Azure Marketplace deployment can be found [here](deploy-from-azure-marketplace).
{% endhint %}

## **Load the Bicep and PowerShell files to Visual Studio Code**

Follow the steps detailed below to deploy the app through bicep deployment, where a PowerShell script is run.

1. To initiate the deployment of the EmbedFAST offer, please contact the [MAQ support team](mailto:embedfastdev@maqsoftware.com) for assistance.
2.  Extract the folder and open it in Visual Studio Code (VS Code). The loaded files should look like this:

    <figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2FVDK8DsSAGbzy6cABv4O4%2F6.5.png?alt=media&#x26;token=7e419785-9f32-41fd-9a97-59094fc8bcf4" alt=""><figcaption></figcaption></figure>

### **Open a terminal window**

From the top menu bar, select **Terminal** -> **New Terminal** to access the PowerShell terminal window.

<figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2FTk5kHSx5CHX01vBY5l5K%2F6.6.png?alt=media&#x26;token=4313e1db-4e6a-46c2-8a50-81ff381b651a" alt=""><figcaption></figcaption></figure>

## **Execute the PowerShell script while bypassing the execution policy**

This step is required to bypass an execution policy that doesn't allow the ZIP file to work with the PowerShell scripts.

1.  Execute command “_**powershell -ExecutionPolicy Bypass -File ".\Master.ps1"**_” in the termina&#x6C;_._ This command will execute a PowerShell script named "Master.ps1" while bypassing the execution policy.

    <figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2FO1XfAhgt4imCCNsyUAaF%2F6.7.png?alt=media&#x26;token=c8ba4160-365b-4e91-8cfe-4a44f78dbd5f" alt=""><figcaption></figcaption></figure>
2. The system will display a variety of prompts. Provide the information as requested. More details regarding the prompts are provided below.

### **Enter your subscription ID**

Follow the steps below to find your subscription ID:

1.  Type “**Subscriptions**" in the [Azure portal](https://portal.azure.com) search bar and select said option as it appears.

    <figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2FZ57b0CsXVqK20nnt20kW%2F6.8.png?alt=media&#x26;token=dc8b0fc2-68d8-4dd9-b12c-c77d35545d78" alt=""><figcaption></figcaption></figure>
2. Once on the page, you will see a list of subscriptions displayed. Select the subscription used [earlier](https://maqsoftware.gitbook.io/embed-fast-technical-documentation/setting-up/prerequisites/set-up-power-bi-and-azure#owner-role-within-the-azure-subscription) you want to deploy your resources to.
3.  Copy the subscription ID as shown below.

    <figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2FnQF877CEpAatpCVDW6u3%2F6.9.png?alt=media&#x26;token=326af9e6-e067-4c21-aadb-5f777598e4ef" alt=""><figcaption></figcaption></figure>
4. In the PowerShell terminal, paste/enter the subscription ID from the previous step.
5.  After completing one prompt, another will enter. In this case, it will now prompt you to enter your tenant ID.

    <figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2F3RKI7QNyRZuGR0uQZ68x%2F7.0.png?alt=media&#x26;token=79bd8e62-b90c-45cc-8da7-4f68eade3c6c" alt=""><figcaption></figcaption></figure>

### **Enter your tenant ID**

Navigate to your **Azure Active Directory** --> **Overview** and copy the tenant ID as shown below. Paste/enter the ID into the PowerShell terminal.

<div data-full-width="true"><figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2Fb1pQw8AxLiaqTb3pRBPo%2Fimage.png?alt=media&#x26;token=7c3d5e3e-5fc4-4ef4-ba9d-4e2fe161b19a" alt=""><figcaption></figcaption></figure></div>

### **Log into Azure through the PowerShell pop-up window**

Log into Azure (with the account used in the previous steps).

<figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2FnaQWJc80wXdhjkhmZAgg%2Fimage.png?alt=media&#x26;token=61fe2f68-ad05-47d0-865d-cc1c25c25533" alt=""><figcaption></figcaption></figure>

### **Enter your resource group name**

Follow the steps below to find the name of your resource group:

1. Type “**Resource groups**" in the search bar of the Azure home page and select said option as it appears.
2. Once on the page, you will see a list of resource groups displayed. Select the resource group that you have created [earlier](https://maqsoftware.gitbook.io/embed-fast-technical-documentation/setting-up/prerequisites/set-up-power-bi-and-azure#resource-group) want to deploy your resources to.
3.  Find the name of your resource group at the top left corner of your page.

    <figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2FvObIfIquRQfM8Cayy6Er%2F7.3.png?alt=media&#x26;token=2f2c02ab-93b8-4193-b609-4ecf05fe6a02" alt=""><figcaption></figcaption></figure>
4. Enter the resource group name in the PowerShell terminal like the previous steps.

### **Enter your application name**

Create and enter a name for your application. The names for all underlying Azure resources will be based on this application name. For example, if you want to deploy a web app for admin, it will be deployed as **admin-<**_**YourAppName**_**>-web-app.**

<figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2FDIaBJV0I1oXMT139AvNb%2F7.4.png?alt=media&#x26;token=dc0b6a9d-0f56-4488-96e5-ec5f053b84f7" alt=""><figcaption></figcaption></figure>

### **Enter the SKU Name**

Choose an [SKU](https://azure.microsoft.com/en-us/pricing/details/app-service/windows/) that fits your needs. Example inputs: B1, B2, S1, S2, etc.

### **Enter your client ID**

This client ID is obtained from the overview page of the app registration previously created for the EmbedFAST API as part of the pre-deployment steps. Follow the steps below to find your client ID:

1. Type “**App registrations**" in the [Azure portal](https://portal.azure.com) search bar and select said option as it appears.

<figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2Fwg1006HCGzQ4sdHaZPUt%2Fimage.png?alt=media&#x26;token=484e1d8b-117c-4963-adb2-0145724bdc2f" alt=""><figcaption></figcaption></figure>

3. Click on **Owned applications** to see a list of applications you registered, including the ones for the API and Power BI Service done in the pre-deployment steps.

<figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2FEbyj2dBB8EvUQMtrTI3y%2F7.6.png?alt=media&#x26;token=8aa34e3d-47ca-4a38-8a15-61db34e33dd7" alt=""><figcaption></figcaption></figure>

4. Next to the **Display name** column is the **Application (client) ID** column which contains the information needed. Find the application registration created for the EmbedFAST API on the list and note down its client ID.
5. Alternatively, clicking the app's name takes you to its summary page where you can also find the client ID and copy it directly to your clipboard.

<figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2F1okIHrP4NerQrVmxLw7D%2F7.7.png?alt=media&#x26;token=5b9dee7b-8a5f-471a-9954-55d13dea8e88" alt=""><figcaption></figcaption></figure>

### **Enter your service principal client ID**

This application ID is obtained from the overview page of the app registration previously created for the Power BI Service as part of the pre-deployment steps.

{% hint style="info" %}
**Note:**

You can follow steps 1-3 [detailed above](#enter-your-azure-a-d-client-id) to obtain your service principal application ID for the Power BI Service. After step 3, find the application registration created for the Power BI Service on the list and note down its client ID.
{% endhint %}

<figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2FyzO2oPuAiqB9vCk6sKsu%2F7.8.png?alt=media&#x26;token=8d73d110-5d11-444e-b035-baf2bb9a8dbd" alt=""><figcaption></figcaption></figure>

### **Enter your service principal object ID**

The object ID is obtained from the enterprise application created for the Power BI Service, which is created by default once we create an app registration for it. Follow the steps below to find the ID:

1. Type "**Enterprise applications**" in the [Azure portal](https://portal.azure.com) search bar and select said option as it appears.

<figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2FfNZ9vFGomcVoIzlpfS4d%2F7.9.png?alt=media&#x26;token=8fe9bfba-7277-408e-8d0b-2050e6fd4d8d" alt=""><figcaption></figcaption></figure>

3.  Search for the name of the app registration created for Power BI Service in the search bar. Your enterprise application will be under the same name.

    <figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2FQlQzfPfV2CHRc82Kgzis%2F8.0.png?alt=media&#x26;token=0a38b69a-096f-470e-b668-2b71245a8166" alt=""><figcaption></figcaption></figure>
4. Click on the application's name to access its details page.
5.  Copy the object ID from the **Object ID** field displayed on the application details page, as shown below.

    <figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2F6XVuDdUGsJoExc6TeMq6%2F8.1.png?alt=media&#x26;token=afa7cf8a-4f8b-462d-8bf3-8c28b72e163c" alt=""><figcaption></figcaption></figure>

### **Enter your service principal name**

On the same page where the [object ID](#enter-your-service-principal-object-id) was obtained from, you can find the name of your service principal at the top left corner of your page.

<figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2FORStb0INJQmeZz5rszCJ%2F8.2.png?alt=media&#x26;token=92c7eb20-472f-488d-8941-4bc7cc0d1439" alt=""><figcaption></figcaption></figure>

### **Enter your service principal client secret**

Follow the steps below to create a client secret:

{% hint style="warning" %}
**Note: The client secret will only be visible at the time of creation.** Take note of it and store it securely for future use for whenever the client secret is required.
{% endhint %}

1. Navigate to the **App registrations** page as shown in the [Enter your subscription ID](#enter-your-subscription-id) ste&#x70;**.**
2. Search for the application created for the Power BI Service once on this page.
3. Click on the application's name to access its details page.
4. Select **Certificates & secrets** (under Manage) from the left pane.

<figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2FJ4Wv62WvCKKsn9ZJygoh%2F8.3.png?alt=media&#x26;token=3c97945b-dbcd-485d-bb0e-13a14e1bfbc0" alt=""><figcaption></figcaption></figure>

5. Click on **New client secret** to create a client secret.

<figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2FnnEOidQDe8iTEPEeQEGu%2F8.4.png?alt=media&#x26;token=3e7c7de4-7b23-48b0-84a6-d295b290738c" alt=""><figcaption></figcaption></figure>

6. Click on **Add** to add a client secret. Enter a description and select when the secret expires.

<figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2FNnCc7Kizlto350hYo0mX%2F8.5.png?alt=media&#x26;token=d5f42adc-81c2-4c9b-a7ef-d92589ff6853" alt=""><figcaption></figcaption></figure>

7. Copy the value of the newly created client secret as shown below.

<figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2FTot8kyoAYafsxR3stolL%2F8.6.png?alt=media&#x26;token=b8d68456-92a1-45c4-bcd3-01e97bda4410" alt=""><figcaption></figcaption></figure>

{% hint style="warning" %}
**Reminder:** Take note of the client secret and store it securely for future use for whenever it is required. The client secret is only visible at the time of creation and will **NOT** be visible again.
{% endhint %}

### **Other details**

* **Enter the sender email:** Provide an email address. This email will be used for sending subscription emails to other users.
* **Enter the sender email password:** Provide the password for the email address provided in the previous step.
* **Enter the SQL admin login username:** Provide the username you use for logging into the database as a SQL Admin.
* **Enter the SQL admin login password:** Provide the password for the username login provided in the previous step.

## **Resource Deployment Options**

After entering a database login password, a menu displaying various options to deploy resources to Azure will appear.

<figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2Fgit-blob-17caa123cc43c00585768feb6cd0e1d28a5e7200%2Fimg51.png?alt=media" alt=""><figcaption></figcaption></figure>

### **Option 1:** Deploy all resources in one go

* A pre-run validation function will be triggered to validate that will perform the resources (check for any existing resources with the same name already exists).
* This option will initiate the deployment of all the resources one by one in a sequential manner, as outlined below.
* The code imports multiple module files to deploy different Azure resources:
  * The ‘**SQLDB**’ module will deploy SQL DB using SQL Script.
  * The ‘**FunctionApp**’ module deploys a function app to Azure using the provided parameters.
  * The ‘**AdminWebApp**’ module deploys an admin web app application using the provided parameters.
  * The ‘**AdminAppInsights**’ module deploys application insights for the admin web app application, with a dependency on the ‘AdminWebApp’ module.
  * The **‘WebApp**’ module deploys a user web application using the provided parameters.
  * The ‘**UserAppInsights**’ module deploys application insights for the user web application, with a dependency on the ‘WebApp’ module.
  * The ‘**KeyVault**’ module deploys a key vault, with dependencies on both the ‘AdminWebApp’ and ‘WebApp’ modules.
  * The ‘**blob**’ module deploys a blob storage resource.
  * The ‘**Role**’ module will provide access to all the webapps and function app to blob storage.
  * The ‘**AIFoundry**’ module deploys ai foundry resource using the provided parameters.
  * The ‘**GptModel**’ module deploys a gpt 4-o model using the provided parameters, with a dependency on the ‘AIFoundry’ module.
  * The code includes output variables ‘**AdminWebAppObjectId**’ and ‘**UserWebAppObjectId**’ that capture the object IDs of the deployed web applications.

### **Option 2: Deploy resources one by one**

* On selecting option 2, a pre-run validation function will be triggered to validate that will perform the resources (check for any existing resources with the same name already exists).
*   A menu displaying the available deployment options numbered from 1 to 8 will appear. You are prompted to enter an option:

    <figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2Fgit-blob-84c3a8c0da2a5eb6cc6f24c16359b6da21432976%2Fimg52.png?alt=media" alt=""><figcaption></figcaption></figure>
* For options 1 to 7, a Bicep script is executed to deploy Azure resources. The code utilizes the ‘**New-AzResourceGroupDeployment**’ cmdlet to deploy resources according to the selected option. It uses a Bicep template and parameter files to configure the deployment.
  * **Option 1**: Azure SQL Database with bacpac
    * This option initiates the deployment of an Azure SQL Database using a bacpac file.
  * **Option 2**: Azure Web Application & Azure Key Vault:
    * Selecting this option initiates the deployment of an Azure Web Application and an Azure Key Vault.
  * **Option 3**: Admin Azure App Insights:
    * This option triggers the deployment of Azure Application Insights for the Admin web application.
  * **Option 4**: User Azure App Insights:
    * Selecting this option initiates the deployment of Azure Application Insights for the user web application.
  * **Option 5**: Azure blob storage:
    * This option deploys the Azure Blob Storage.
  * **Option 6**: Azure Role Based Access for connection between WebApp, KeyVault and Blob.
    * A role resource deployment is initiated. The code performs necessary actions to deploy roles that require admin access.
  * **Option 7**: Azure AI Foundry and Gpt Model:
    * Selecting this option initiates the deployment of Azure AI Foundry and Gpt Model.
* If **option 8** is selected, it allows the you to go back to the previous menu.

<figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2Fgit-blob-44bff047c4429a35d6a636ec6e5eca2e5df2ca63%2Fimg57.png?alt=media" alt=""><figcaption></figcaption></figure>

* If **option 9** is selected, you will exit the program.

### **Option 3:** Publish SDK Build to WebApp one by one

*   On selecting option 3, a menu with the following options will appear where you are prompted to enter a selection. You should select the options in order as per the numbering:

    <figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2FYvZ86alZ3wvu4du8ZHtt%2F9.2.png?alt=media&#x26;token=eddc73b3-96b4-40c9-8b9d-0d3c5b8bd024" alt=""><figcaption></figcaption></figure>

    * **Option/step 1**: The code initiates the publishing process for the admin web application. It uses the **‘Publish-AzWebApp**’ cmdlet to publish the build from the specified archive path to the admin web application.
    * **Option/step 2**: The code initiates the publishing process for the build to the function application.
    * **Option/step 3**: The code initiates the publishing process for the build to the web application.
    * **Option/step 4**: It takes you back to the main menu.
    * **Option/step 5**: The code exits the program.
    * For any other invalid option: An error message is displayed, indicating that an invalid value was provided.

### **Option 4**: Deploy and Publish UI resources.

* This option will:
  * **Option/step 1**: This option triggers the deployment of UI App Insights.
  * **Option/step 2**: The code initiates the publishing process for the build to the UI service.
  * **Option/step 3**: It takes you back to the main menu.
  * **Option/step 4**: The code exits the program.

### **Option 5**: Perform Post Deployment Operation.

This option will:

* Add your client IPv4 address to Set Server Firewall.
* Grant the necessary permissions to the service principal app registration on the Database. It will give admin access on the Database created.
* Add the Power BI App Service principal as an external Azure AD user.

### **Option 6: Validate Resources**

<figure><img src="https://2643060172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIwWVFb1sEdUq6IwVu5D2%2Fuploads%2Fgit-blob-17caa123cc43c00585768feb6cd0e1d28a5e7200%2Fimg51.png?alt=media" alt=""><figcaption></figcaption></figure>

A pre-run validation function will perform resource validation. This function is designed to be used before executing a run, primarily to ensure the availability or correctness of any required resources with the same name that have been previously deployed.

***
