System Requirements

Hint

See the Deployment Guide for the Azure Marketplace deployment steps.

Overview

The AI Analyst is deployed into your own Azure tenant as an Azure Managed Application. This page lists everything that must be in place before you start the deployment. Checking these points in advance is the single most effective way to keep the deployment short, because almost every failed deployment is caused by a missing permission, a missing resource provider, or missing quota.

Existing dab Prerequisites

Before deploying AI Analyst, the following must already be available:

• dab Nexus
• A license for the dab AI Analyst

Note

The dab Knowledge Hub provides the SAP and analytics expertise that AI Analyst reasons with. AI Analyst therefore cannot be operated without a Knowledge Hub and to access it the AI Analyst License is required.

Azure Requirements

Subscription and Permissions

• An Azure subscription that AI Analyst is deployed into
• Owner on the target scope, or Contributor plus User Access Administrator
• Permission to deploy the Azure Marketplace offer

Important

A pure Contributor role is not sufficient. The deployment creates role assignments so that the application can read its own secrets from Key Vault with its managed identity. Without User Access Administrator, the deployment fails at the role assignment step.

Required Resource Providers

The following resource providers must be registered in the target subscription:

Resource provider	Why it is needed
Microsoft.Web	App Service and App Service Plan that run AI Analyst
Microsoft.KeyVault	Key Vault that stores the connection string, API keys, and secrets
Microsoft.CognitiveServices	Azure AI Foundry account and the AI model deployment
Microsoft.Network	Virtual network, subnets, and the private endpoint to the dab Knowledge Hub
Microsoft.ManagedIdentity	Managed identity that AI Analyst uses to access Key Vault Secrets
Microsoft.App	Platform components of the managed application

You can register providers in the Azure Portal under Subscription -> Settings -> Resource providers, or by running:

az provider register --namespace Microsoft.Web
az provider register --namespace Microsoft.KeyVault
az provider register --namespace Microsoft.CognitiveServices
az provider register --namespace Microsoft.Network
az provider register --namespace Microsoft.ManagedIdentity
az provider register --namespace Microsoft.App

Note

Registration is asynchronous and can take a few minutes. Wait until every provider shows the status Registered before you start the deployment.

Required Quota

The deployment requests capacity in two places. Both are checked by Azure at deployment time, and both fail the deployment if the subscription has no headroom.

Quota	What to check
Azure OpenAI tokens per minute (TPM)	In the target Cognitive Services region, for the model family you plan to use. Quota is shared across all deployments of that model family in the same subscription and region.
App Service compute	The selected App Service Plan size must be available in the deployment region. New or trial subscriptions frequently have a limit of 0 for the required VM family.

You can check the model quota in the Azure Portal under Azure AI Foundry -> Quotas, or by running:

az cognitiveservices usage list --location <region> --output table

Note

If the available headroom is lower than the capacity you plan to deploy, request a quota increase before deployment day. Quota increase requests are processed by Microsoft and can take time.

Database Requirements

A database that stores the relevant result tables, specifically:

• A Microsoft SQL Server or Azure SQL Server database that holds the dab Nexus analytic run results
• A database user with read-only access to the tables AI Analyst analyzes
• A connection string in ADO.NET (or ODBC) format, with encryption enabled
• Network connectivity from Azure to that database

Note

Use the database connection string for the database used by the analytic run, not the dab Nexus application database.

Important

AI Analyst reaches your database through the outbound traffic of its virtual network. Clarify the network path with the team that administers the database before the deployment. The available options are described in the Deployment Guide.

Values You Need During the Deployment

Have the following ready before you open the wizard:

Value	Where it comes from
Subscription, resource group, and region	You
Database connection string	You
SQL base table schema	You, default Results
Allowed IP ranges in CIDR notation	Your IT department, for example 203.0.113.0/27
AIA API Key	You generate it, at least 32 characters
Session Token Secret	You generate it, at least 32 characters
Knowledge Hub API Key	Provided by dab as part of AIAnalyst License
Private Link request message	You, used by dab to identify your request

Important

The AIA API Key and the Session Token Secret cannot be read back from the deployment outputs later, and you must enter them again on every redeployment. We recommend to create and store them in a password manager before you start.