Deploying dab AI Analyst

Hint

Review the System Requirements first. Most deployment problems are caused by a prerequisite that was not prepared.

Before You Start

dab AI Analyst is deployed from the Azure Marketplace as an Azure Managed Application. The deployment has six configuration tabs and a final Review + create step, which you complete in order. Confirm the following before you begin:

• dab Nexus is already in use
• The AI Analyst License key provided by dab as part of the AI Analyst License is available, see https://knowledge.dab-europe.com/portal/license-management
• The target Azure subscription is selected
• The required resource providers are registered
• The deploying user has Owner, or Contributor plus User Access Administrator role(s)
• App Service compute quota are available in the target regions
• The database connection string to the database storing your Nexus analytic run results
• Azure Foundry LLM deployment quota are available in the target regions

Note

The database connection string should reference the database used by the dab AnalyticSuite run, not the dab Nexus application database.

Open the Marketplace Offer

dab AI Analyst is published as a public offer within the Azure Marketplace and has to be selected.

1. Basics

This tab defines where the application and its resources are created.

Field	What to enter
Subscription	The Azure subscription that AI Analyst is deployed into
Resource Group	A new or existing resource group for the managed application
Region	The Azure region for the virtual network, Key Vault, and App Service
Application Name	A name for the managed application
Managed Resource Group	The resource group that holds the resources of the managed application

Hint

Select a region close to your database. The region chosen here does not determine where the AI model is deployed. You select that separately in step 6.

2. Application Settings

This tab defines general deployment settings.

2.1 App Service Plan Size

Select the plan size for the App Service that runs AI Analyst. This is the AI Analyst backend: it runs the agents that are build on the deployed Azure AI Foundry model. You can scale the plan up or down later without redeploying.

SKU	Cores	RAM	Recommended for
P1v3	2	8 GB	Recommended default
P1mv3	2	16 GB	Memory-intensive workloads
P1v4	2	8 GB	Current generation, comparable to P1v3
P2v4	4	16 GB	High number of parallel users
P3v4	8	32 GB	Enterprise scale

We recommend starting with P1v3 and scaling up only if performance requires it.

2.2 Secrets

Both secrets are values that you create.

Field	Why it is needed
AIA API Key	Secures the communication between the AI Analyst Visual in the PowerBi Dashboard and the AI Analyst backend. Every client that calls the API needs this key.
Session Token Secret	Signs the user sessions so that the application can verify that a user is logged in. Users never see this value.

Each value should be at least 32 characters long and needs to be stored as they are required post deployment.

Hint

Use a password manager to create and store your secrets.

Important

Use only the characters A-Z, a-z, and 0-9. Characters such as ;, ", &, %, or spaces can cause parsing problems in HTTP headers and in the downstream configuration.

3. Networking Security

By default, AI Analyst and its supporting services are only reachable through their own virtual network. This tab defines whether users can also reach the application from outside that network, for example from your corporate office.

Field	What to enter
Add IP Addresses to Allowlist	Yes if users access AI Analyst from outside the virtual network, otherwise No
Allowed IP Ranges (CIDR)	The permitted IP ranges in CIDR notation, separated by commas, for example 203.0.113.0/27, 198.51.100.42/32

Add the IP range of your office so that you can open the AI Analyst interface and read the Key Vault secrets in the Azure Portal. You can change the allowlist later in the Azure Portal under App Service -> Networking -> Access restrictions.

Note

If you select No, the API is not reachable from outside the virtual network and you need to set up a custom connection to the virtual network, such as network peering.

4. Database Connection

This tab defines the database that AI Analyst queries. The value is stored in Key Vault after the deployment and is never written to logs or application settings.

Field	What to enter
Database Connection String	The connection string for the database that holds the analytic run results
SQL Base Table Schema	The schema that dab Nexus exports the tables required by AI Analyst into, by default Results

The following connection string formats are supported:

• ADO.NET format, recommended:

  Server=tcp:myserver.database.windows.net,1433;Database=mydb;User ID=myuser;Password=mypassword;Encrypt=yes;TrustServerCertificate=no;

• ODBC format, alternatively:

  Driver={ODBC Driver 18 for SQL Server};Server=tcp:myserver.database.windows.net,1433;Database=mydb;Uid=myuser;Pwd=mypassword;Encrypt=yes;TrustServerCertificate=yes;

Supported Authentication Methods:

• SQL user and password (recommended) — create a dedicated, read-only SQL user for dab AI Analyst and put its credentials in the connection string as shown above. This works out of the box and needs no further setup.
• Managed identity (optional) — the App Service can instead authenticate with the managed identity of the Managed Application it is deployed with. Use a connection string without User ID/Password and with Authentication=Active Directory Managed Identity. This requires additional setup on your side after deployment: you have to create a contained database user for the managed identity and grant it read access. Choose this only if your organisation's policy requires it.

Warning

Since Generative AI is used, ensure that the user that allows the dab AI Analyst to interact with your data has read-only access.

Important

The Database must be reachable by the Azure App Service for the dab AI Analyst to work. If your database is not publicly available you have to manually configure reachability post-deployment.

An unreachable database does not stop the deployment itself. The application starts, logs Database warm-up failed, and stays unusable until the network path is corrected. Confirm the path with the team that administers the database before deployment day.

5. AI Model Configuration

This tab defines the Azure OpenAI model that AI Analyst reasons with, and how much throughput it is allowed to use.

Field	What to enter
Cognitive Services Region	The region the model is deployed in. It must have quota available for the selected model. We recommend a quota of 1.2 million tokens per minute for every 10 users.
Model	The model that AI Analyst uses. The dropdown only offers models available in the selected region.
Capacity (Quota Units)	The throughput reserved for AI Analyst. One unit equals 10,000 tokens per minute.

We recommend the model gpt5.6-luna, which combines strong reasoning with low cost; gpt5.6-terra is slightly better but costs noticeably more. Select a region that has quota available for this model and that is close to your deployment region.

Important

Capacity is shared across all deployments of the same model family in the same subscription and region. If you request more capacity than is available, the deployment fails. Start with a low value and increase it later in the Azure Portal.

5.1. AI Model Capacity

5.2. AI Model Performance

6. License and Knowledge Hub

AI Analyst enriches its answers with the SAP and analytics expertise of the dab Knowledge Hub. This tab connects your deployment to that service over a private link, so that the traffic never traverses the public internet.

Field	What to enter
Knowledge Hub API Key	The license key you received from dab
Private Link Request Message	A message that identifies your request (company and responsible person), for example Contoso AG (m.mustermann(at)cag.com) - productive AI Analyst deployment

Note

The private link connection is created in the state Pending and has to be approved by dab. AI Analyst does not work without the approval.

Warning

A Private Link Request Message that does not contain either the company name or the responsible person will be rejected.

Review and Create

Azure validates all parameters and shows a summary. Check that all secrets are filled in, that the regions and the model are correct, and that the connection string is complete. Then click Create. The deployment takes about three to five minutes.

Hint

Continue with After the Deployment to verify the result and to request the private link approval.