> ## Documentation Index
> Fetch the complete documentation index at: https://docs.generalvalidation.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up your Azure environment

> Connect the hosted application to a customer-owned execution environment using the reviewed Deploy to Azure template.

General Validation hosts the application. Your team deploys the execution
Data Factory and result storage into your own Azure subscription through the
application's setup flow.

<span id="what-you-need" />

## Prerequisites

* **Organization Owner access in General Validation.** For a new organization,
  follow [Getting started](/getting-started) to sign in with Microsoft
  and start the trial.
* **An Azure subscription in your connected Entra directory.** The person
  deploying the template needs Owner rights on that subscription. Deployment
  creates resources, custom roles, and role assignments.
* **A directory administrator when consent is required.** Azure subscription
  ownership and Entra admin-consent permissions are separate.
* **A suitable Azure region.** Choose the region for your customer execution
  resources.
* **An optional Entra reader group.** Have its group object ID ready if more
  people should be able to read exact results and captured failed rows.

You sign in directly with Microsoft. Setup uses your subscription and directory
identifiers; Azure credentials are never entered into General Validation.

<span id="what-to-expect" />

## 1. Name the environment

Open **Environment** in the application. Enter:

| Field                              | Value                                                                       |
| ---------------------------------- | --------------------------------------------------------------------------- |
| Environment name                   | A name your team will recognize                                             |
| Subscription ID                    | The subscription that will own execution and result storage                 |
| Azure region                       | The Azure region for those resources                                        |
| Browser reader group ID (optional) | The object ID of the Entra group permitted to read browser result artifacts |

Choose **Continue to setup**. These choices determine the deployment template,
including its resource names. Configure the reader group here before opening
the Azure deployment form.

The Owner who starts setup receives read access to the browser-artifact
container. Adding the optional group extends that storage access to its
members; each person still needs General Validation membership to use the app.

## 2. Complete directory consent if requested

Setup prepares General Validation's application identity in your directory. If
that identity has not been admitted, the page shows **Admin consent needed**.

Have a directory administrator open **Grant admin consent** and review the
request. When consent is complete, an organization Owner returns to the setup
page and chooses **Retry preparation**.

Consent enables the directory connection. The Azure template in the next step
establishes the specific resource permissions for this environment.

<span id="how-signed-release-verification-works" />

## 3. Review and deploy the template

Expand **What this creates, and what we can access** to review the resource
group, Data Factory, storage account, callback identity, and allowed actions.
**Template and version details** provides the exact template and its SHA-256.
See [Azure resources and permissions](/what-general-validation-provisions)
for an explanation of each resource and grant.

Choose **Deploy to Azure**. The Azure form shows the subscription, region, and
resource names saved in General Validation. Review them and deploy the
template under your Azure account.

The editable discovery option grants read-only Data Factory metadata access
across the subscription. It is enabled by default. Turn it off if your team
will grant metadata access separately on each discovery factory.

For a deployment pipeline or Cloud Shell, expand **Prefer the Azure CLI?** and
use the exact command printed by the setup page. It selects your saved
subscription and deploys the same template. The template link expires; reload
the setup page to obtain a fresh link if Azure cannot retrieve it.

## 4. Verify and finish

Wait for Azure to report a successful deployment. Return to General Validation
and choose **I've deployed it, verify and finish**.

General Validation checks the deployed resources against the reviewed template
and installs the Data Factory content needed to prepare datasets, run
validations, and deliver results. The environment becomes ready when these
checks finish.

If verification pauses, expand **Resources to verify**. Reapply the reviewed
template to address missing or outdated resources, then choose **Verify
again**. Follow the reported resource issue rather than deleting resources to
clear the status.

Once ready, continue with [Getting started](/getting-started#3-discover-and-prepare-your-datasets)
to connect discovery sources and import your first datasets.

<span id="examples" />

<span id="upgrading" />

## Repair and updates

An Owner can choose **Repair environment** when setup or an existing environment
needs attention. Repair checks the resources and restores General Validation's
Data Factory content. Missing Azure resources are listed for you to redeploy.

Use the current action and template shown on the environment page for an
update. An application update does not by itself update your customer
execution environment.

Some earlier environments require replacement instead of Repair. The
environment page may show a read-only view with **Disconnect** available and
no installer. When this action is offered, an Owner can disconnect the earlier
environment, wait for cleanup to complete, then create a new environment using
the current setup flow. Disconnect retains Azure resources and results; it
does not upgrade them or transfer them to the new environment.

If Disconnect is unavailable or fails, follow the displayed issue and contact
[support](mailto:support@generalvalidation.com). Do not delete retained results
to work around a setup error.

## Network posture

The standard customer template uses public Azure endpoints with HTTPS,
Microsoft Entra authentication, and Azure RBAC. Results storage requires TLS
1.2 and disables anonymous and shared-key access. It does not establish a
private network or an air-gapped installation.

Your execution Data Factory must be able to reach the selected data sources.
Users viewing exact results need network access to customer storage. Review
private-network requirements with
[support](mailto:support@generalvalidation.com) before setup. See
[Security and the data boundary](/security-and-data-boundary) for the
complete processing boundary.

<span id="uninstall" />

## Disconnect and resource removal

Use **Environment → Disconnect** as an Owner to stop the environment's
connection. Disconnect waits for active validation work, removes the
source-storage grants General Validation created, and revokes its execution
operator and source-grant delegation assignments.

The resource group, Data Factory, storage, identities, results, and artifacts
remain in your subscription. Customer-managed grants and other retained
installer grants also remain. Disconnect does not delete your Azure resources
or cancel your subscription.

If you want to remove the Azure environment, first preserve the data your
retention policy requires and inventory its dependencies and remaining role
assignments. Your Azure administrator can then remove the dedicated resources
and grants. Manage the product subscription separately in
[Billing](/licensing-and-activation).