After the Deployment
This page continues the deployment. Complete the deployment first.
1. Verify the Deployment
1.1 Check the Deployment Outputs
Open the resource group, select Deployments, open the deployment, and select Outputs.
| Output | What it shows |
|---|---|
appServiceUrl | The URL that AI Analyst is reachable at |
keyVaultName | The Key Vault that stores the secrets |
cognitiveServicesName | The Azure AI Foundry account |
knowledgeHubPrivateLinkState | Whether the connection to the Knowledge Hub is approved |
1.2 Check the Application
- Open the App Service in the managed resource group.
- On the Overview blade, confirm that Status shows
Running. - Open Monitoring -> Log stream and confirm that the container image was pulled and that the application started without errors.
If the status is Running and the log stream shows a clean start, the deployment is healthy.
If your IP range is on the allowlist, you can additionally open the application URL in a browser. From an address that is not on the allowlist, both the browser and the API return 403. This is the allowlist working as configured, not a failed deployment.
1.3 Check/Configure Database Reachability
AI Analyst uses virtual network integration, so all of its outbound traffic to your database leaves through the integration subnet of its own virtual network. What you have to configure depends on where the database is located.
| Database location | What to configure |
|---|---|
| Azure SQL Database with public endpoint | Enable Allow Azure services and resources to access this server on the networking blade of the SQL server. For a tighter setup, allowlist the outbound IP addresses of the App Service instead. |
| Azure SQL Database with private endpoint | Peer your virtual network with the AI Analyst virtual network, and link the privatelink.database.windows.net private DNS zone to the AI Analyst virtual network so that the private name resolves. |
| MSSQL Server on premises | Establish connectivity through App Service Hybrid Connections. |
Official Microsoft Documentation:
The Azure WebApp logs Database warm-up failed on startup until the database is reachable.
2. Request the Private Link Approval
The deployment creates a private endpoint to the dab Knowledge Hub. The connection stays in the state Pending until dab approves it, and AI Analyst answers without the dab background knowledge in the meantime.
Send your subscription ID and the private link request message you entered during the deployment to your dab contact, or to delivery(at)dab-gmbh.de, so that dab can match and approve the connection.
3. Update an Existing Deployment
To change settings later, start the deployment again from the Marketplace offer and select the same resource group. Azure updates the existing resources in place and only changes the properties that differ.
The deployment cannot read back the existing secrets. On every redeployment you have to enter all secret values again, even if you only want to change the IP allowlist. Enter the same values to keep them unchanged, or new values to rotate them. Empty or placeholder values overwrite the working secrets and break the deployment.
Common changes are:
- Scaling the App Service Plan up or down
- Adding IP ranges to the allowlist, which you can also do without a redeployment in the Azure Portal under App Service -> Networking -> Access restrictions
- Changing the model or its capacity
- Rotating the AIA API Key or the Session Token Secret
DAB does not prescribe a rotation interval for the AIA API Key, the Session Token Secret, or the database credentials. Rotate them according to your organisation's security policy.
A rotation does not require a redeployment: update the secret value in the Key Vault of the Managed Application and restart the web app under App Service -> Overview -> Restart. The application reads the new value on start-up. ::
5. Update the Application to a New Version
dab AI Analyst runs as a container image that is pulled from the DAB container registry. To update to the latest version, restart the web app in the Azure Portal under App Service -> Overview -> Restart. On start-up the App Service pulls the newest image; no redeployment and no re-entering of secrets is required.
This covers application updates only. If a new version also requires changes to the underlying infrastructure (for example new resources, settings, or permissions), DAB will inform you in advance and provide instructions. In that case the update is done by redeploying the Managed Application as described in section 3.
4. Get Help
If the deployment fails, see Deployment Issues. If the application is deployed but does not behave as expected, see Issues After the Deployment.