Azure in your own subscription

This page applies only if Demiton runs in your own Azure subscription. Start with Securing Azure, which applies to every customer. Here, ownership splits in two: you own the tenant, subscription, network, role assignments, logging and Defender; Demiton owns the application, images, database schema and deploy pipeline. Before changing a setting the table marks as breaking something, talk to us.

The network decision comes first, because it cannot be reversed in place. A Container Apps environment cannot change network type after creation. Moving to a virtual network means a new environment, then moving the apps and DNS across, so plan it with us as a project with an outage window. Until then PostgreSQL and storage have nothing private to sit behind, and the private-network controls below stay open as accepted risks with a date.

Table

ID	Resource	Target	Do not, because
R1	Container Apps environment	In your virtual network, with outbound traffic through a NAT gateway or firewall
R2	API ingress	External and HTTPS only, with only the API app exposed. Redis and workers stay internal	Do not restrict the API to office IPs: the mobile app, Outlook add-in and AI clients all call it from outside
R3	App secrets	Held as Container Apps secrets, never plain environment variables
R4	PostgreSQL network	Private access or a private endpoint, and no 0.0.0.0 firewall rule, which admits every Azure customer’s resources to the login prompt
R5	PostgreSQL settings	require_secure_transport on, TLS 1.2 or later, backups kept 14 days or more	Do not turn off password authentication: the app connects with a password
R6	Storage	TLS 1.2, HTTPS only, anonymous blob access off, blob and container soft delete on, versioning on	Do not disable shared key access: the app signs its links with the account key. Do not deny public network access: report downloads and phones use 15-minute signed links directly
R7	Container registry	Admin user off. AcrPull for the app identity, AcrPush for the deploy identity only
R8	Azure OpenAI	Public network access limited once R1 is done, and keys rotated with Demiton	Do not disable key authentication: the connector uses an API key
R9	Role assignments	No Owner for outsiders. Deploy identity holds Contributor on the resource group only, never the subscription. People use named accounts through Privileged Identity Management
R10	Deploy identity	Client secret on 90-day rotation today. A federated credential is the target, and needs a change on our side, so ask us
R11	Activity and Entra logs	Exported to Log Analytics, kept 90 days or more, with a daily cap that cannot stop ingestion during an incident
R12	Resource diagnostics	PostgreSQL and storage audit logs sent to the same workspace
R13	Defender for Cloud	Foundational CSPM on, secure score reviewed. Decide on the paid Containers, Storage and Open-source databases plans, which carry a cost
R14	Delete locks	CanNotDelete on PostgreSQL and the storage account	Do not lock the whole resource group: deploys create and remove resources in it

---

Next steps

• Auditing Azure - check the configuration with read-only commands
• Securing Azure - the tenant, connector app registrations and sign-in