diff --git a/docs/GETTING-STARTED.md b/docs/GETTING-STARTED.md index 950e67d..214ae17 100644 --- a/docs/GETTING-STARTED.md +++ b/docs/GETTING-STARTED.md @@ -73,14 +73,14 @@ IDs handy. To register manually, open the customer tenant's 3. On **Overview**, save the **Directory (tenant) ID** and **Application (client) ID** privately. Use the client ID, not the Object ID. -![App registration form with an example name, Single tenant only selected, and no redirect URI](images/onboarding/app-registration.png) +![App registration form with CYOT-CONSTO, the test directory, Single tenant only selected, and no redirect URI](images/onboarding/app-registration.png) *Some portal versions label the account type **Single tenant only**. Select the customer directory. -The example above is an unsaved form and cannot be reused.* +The CYOT-CONSTO example above uses a nonproduction test directory.* Use these labels to find the IDs: -![App registration Overview with Application client ID and Directory tenant ID identified for setup and Object ID marked DO NOT USE](images/onboarding/app-registration-overview.png) +![CYOT-CONSTO App registration Overview with Application client ID and Directory tenant ID identified for setup and Object ID marked DO NOT USE](images/onboarding/app-registration-overview.png) *Use **Application (client) ID** for `-ApplicationId` and **Directory (tenant) ID** for `-TenantId`. The **Object ID** is not either of these setup inputs. All ID values are hidden in this example.* @@ -111,6 +111,11 @@ Review the downloaded script, then run it: .\Setup-Epp.ps1 ``` +![Azure Cloud Shell in PowerShell mode downloading and starting setup for CYOT-CONSTO](images/onboarding/cloud-shell-run-setup.svg) + +*This CYOT-CONSTO nonproduction walkthrough keeps the recognizable application name and shell path visible. +Only the tenant ID is hidden. Review the downloaded script before running it.* + On a shared workstation, use `.\Setup-Epp.ps1 -ForceAuthentication` for a fresh sign-in. JavaScript is used by default, without a language prompt. To deploy another language, run @@ -137,6 +142,11 @@ it does not ask you to choose EU or Global. Select the Azure region, then comple - **Resource prefix:** press Enter to use `epp`, or enter 2-8 lowercase letters/digits, starting with a letter. When rerunning an existing deployment, use its original prefix. +![Azure Cloud Shell shows the CYOT-CONSTO provider, platform, hosting plan, and resource prefix choices](images/onboarding/cloud-shell-choose-options.svg) + +*The walkthrough selected Telesign Global routing, Node.js, Flex Consumption FC1, and the +`consto` resource prefix. These are example choices, not recommendations for every deployment.* + Complete required sign-in, MFA, or administrator consent. Resolve preflight errors before approval. For existing encryption credentials, follow @@ -171,6 +181,13 @@ Insights, diagnostics, Easy Auth, and scoped role assignments. Do not precreate Keep `epp-output` private. Its [summary](../setup/docs/README.md#read-the-deployment-summary) records the selected tenant, subscription, provider route, runtime, plan, resource names, endpoint, application, package provenance, and encryption certificate references. No private key is downloaded. +Cloud Shell sessions are ephemeral, so securely download or otherwise retain the private +`epp-output` deployment summary and public certificate before closing the session. + +![Azure Cloud Shell deployment completion summary showing the CYOT-CONSTO resources and hidden endpoint](images/onboarding/cloud-shell-deployment-complete.svg) + +*The nonproduction CYOT-CONSTO resource names are shown so readers can recognize the naming +pattern. The endpoint is hidden, and the full deployment summary remains private.* Setup verifies the private-key reference and **Easy Auth** before opening public access. Keep Easy Auth enabled. It also verifies that `SendOtp` is registered before reporting success. If setup @@ -180,9 +197,9 @@ fails, use the To find the deployed resources, open **Azure portal > Resource groups** and select the group listed in your deployment summary. -![Example regional resource group showing a Function App, monitoring, Key Vault, managed identity, hosting plan, and storage](images/onboarding/resource-group.png) +![CYOT-CONSTO regional resource group showing the consto Function App, monitoring, Key Vault, managed identity, FC1 hosting plan, and storage](images/onboarding/resource-group.png) -*This Premium test deployment shows the expected resource types. Your list can differ.* +*This FC1 nonproduction deployment shows the actual CYOT-CONSTO resource names. Your list can differ.* ## 4. Connect your provider and test @@ -196,9 +213,10 @@ In your Function App, open **Settings > Authentication**. Check that authenticat **Enabled**, access is set to **Require authentication**, and unauthenticated requests receive **HTTP 401 Unauthorized**. These are checks, not instructions to change the approved caller. -![Function Authentication page showing Enabled, Require authentication, and Return HTTP 401 Unauthorized](images/onboarding/authentication.png) +![CYOT-CONSTO Function Authentication page showing Enabled, Require authentication, and Return HTTP 401 Unauthorized](images/onboarding/authentication.png) -*The **Microsoft** identity provider validates the caller. It is not the SMS or voice provider.* +*The Function and identity-provider labels remain visible. Only the client ID is hidden. The +**Microsoft Entra ID** identity provider validates the caller; it is not the SMS or voice provider.* Complete the [approved endpoint checks](ONBOARDING.md#validate-the-deployed-endpoint): diff --git a/docs/MONITORING.md b/docs/MONITORING.md index 8303a7a..74adc1a 100644 --- a/docs/MONITORING.md +++ b/docs/MONITORING.md @@ -29,12 +29,15 @@ out of queries, alerts, exports, and screenshots. 1. Open the Function App from the deployment summary. 2. Select **Monitoring > Application Insights**, then open the linked resource. - ![Function App Monitoring menu with Application Insights selected and its connected resource link](images/onboarding/monitoring-link.png) + ![CYOT-CONSTO Function App Monitoring menu with the consto Application Insights resource link](images/onboarding/monitoring-link.png) 3. On the Application Insights **Overview**, open **Logs workspace**. 4. In the workspace, select **Logs** and use **KQL mode**. - ![Application Insights Overview showing the Logs workspace link with account and connection details redacted](images/onboarding/monitoring-workspace.png) + ![CYOT-CONSTO Application Insights Overview showing the consto resource group and Logs workspace while identifiers and connection details remain hidden](images/onboarding/monitoring-workspace.png) + + *Nonproduction resource names and the subscription display name remain visible. Subscription and + application IDs, the instrumentation key, and the connection string remain hidden.* Record the Function App, Application Insights resource, workspace, runtime, region, deployment version, owner, and expected traffic or test schedule. For several regions, keep one row per origin. @@ -70,7 +73,7 @@ AppRequests | order by ResultCode asc ``` -![Workspace Logs in KQL mode with a scoped request-status query, Run button, and one aggregate result row](images/onboarding/logs-query-results.png) +![CYOT-CONSTO workspace Logs in KQL mode with a query scoped to the consto Function App and one aggregate result row](images/onboarding/logs-query-results.png) `StoredRows` counts stored telemetry, not delivered messages. Sampling can change the count. Evaluation and live calls can both return `200`. No rows means no matching data in this scope and diff --git a/docs/ONBOARDING.md b/docs/ONBOARDING.md index 83d71cc..b84e087 100644 --- a/docs/ONBOARDING.md +++ b/docs/ONBOARDING.md @@ -140,7 +140,7 @@ secret names required by the selected adapter. 2. Open that vault in **Azure portal > Key vaults**. 3. Select **Objects > Secrets > Generate/Import**. - ![Key Vault Objects menu with Secrets selected and the Generate/Import action visible](images/onboarding/key-vault-secrets.png) + ![CYOT-CONSTO Key Vault Objects menu with the consto vault name, Secrets selected, and Generate/Import visible](images/onboarding/key-vault-secrets.png) 4. Create the required secret with the raw credential, such as `sinch-api-token` for Sinch. 5. Verify its name, enabled state, dates, and version without viewing its value. diff --git a/docs/images/onboarding/app-registration-overview.png b/docs/images/onboarding/app-registration-overview.png index c227e9a..f4320cc 100644 Binary files a/docs/images/onboarding/app-registration-overview.png and b/docs/images/onboarding/app-registration-overview.png differ diff --git a/docs/images/onboarding/app-registration.png b/docs/images/onboarding/app-registration.png index 58c82d8..800dd48 100644 Binary files a/docs/images/onboarding/app-registration.png and b/docs/images/onboarding/app-registration.png differ diff --git a/docs/images/onboarding/authentication.png b/docs/images/onboarding/authentication.png index c47a589..f37d402 100644 Binary files a/docs/images/onboarding/authentication.png and b/docs/images/onboarding/authentication.png differ diff --git a/docs/images/onboarding/cloud-shell-choose-options.png b/docs/images/onboarding/cloud-shell-choose-options.png new file mode 100644 index 0000000..c50c016 Binary files /dev/null and b/docs/images/onboarding/cloud-shell-choose-options.png differ diff --git a/docs/images/onboarding/cloud-shell-choose-options.svg b/docs/images/onboarding/cloud-shell-choose-options.svg new file mode 100644 index 0000000..072304d --- /dev/null +++ b/docs/images/onboarding/cloud-shell-choose-options.svg @@ -0,0 +1,16 @@ + + CYOT-CONSTO setup choices in Azure Cloud Shell + The setup selects Telesign Global routing, Node.js, Flex Consumption FC1, and the consto resource prefix. + + + Provider selection + Provider: Telesign Tenant scope: Global + Choose your platform: + [1] Node.js[2] .NET[3] Python + Platform number or name: 1 + Service plan selection + Flex Consumption has a free usage grant, not a zero-cost guarantee. Additional usage, Key Vault, storage, and telemetry can incur charges. + Service plan number or name: 1 Resource prefix: consto Application: CYOT-CONSTO + Selected: Node.js • Flex Consumption FC1 + + diff --git a/docs/images/onboarding/cloud-shell-deployment-complete.png b/docs/images/onboarding/cloud-shell-deployment-complete.png new file mode 100644 index 0000000..a3792cb Binary files /dev/null and b/docs/images/onboarding/cloud-shell-deployment-complete.png differ diff --git a/docs/images/onboarding/cloud-shell-deployment-complete.svg b/docs/images/onboarding/cloud-shell-deployment-complete.svg new file mode 100644 index 0000000..1345a0c --- /dev/null +++ b/docs/images/onboarding/cloud-shell-deployment-complete.svg @@ -0,0 +1,26 @@ + + Completed CYOT-CONSTO nonproduction deployment + Azure Cloud Shell lists the created FC1 resources. Resource names remain visible, while the Function endpoint is hidden. + + + Deployment completed + Azure resources created or updated + ResourceName + ------------ + Resource groupconsto-epp-rg-5a7680d1 + Function Appconsto-epp-func-5a7680d1 + Hosting planconsto-epp-plan-5a7680d1 + Storage accountconstoeppsa5a7680d1 + Blob containerpackages + Key Vaultconsto-epp-kv-5a7680d1 + Function App identitySystem-assigned + Outbound identityconsto-epp-outbound-5a7680d1 + Log Analyticsconsto-epp-logs-5a7680d1 + Application Insightsconsto-epp-insights-5a7680d1 + Diagnostic settingsConfigured + Application: CYOT-CONSTO + Function endpoint:endpoint hidden + Service plan: FC1 + Certificate renewal is manual. Retain the private deployment summary securely. + + diff --git a/docs/images/onboarding/cloud-shell-run-setup.png b/docs/images/onboarding/cloud-shell-run-setup.png new file mode 100644 index 0000000..514bd8f Binary files /dev/null and b/docs/images/onboarding/cloud-shell-run-setup.png differ diff --git a/docs/images/onboarding/cloud-shell-run-setup.svg b/docs/images/onboarding/cloud-shell-run-setup.svg new file mode 100644 index 0000000..f7dfdc7 --- /dev/null +++ b/docs/images/onboarding/cloud-shell-run-setup.svg @@ -0,0 +1,28 @@ + + Azure Cloud Shell starting setup for CYOT-CONSTO + Cloud Shell downloads and starts the setup script. The tenant ID is hidden; the non-sensitive application name and shell path remain visible. + + + + + ↔ Switch to Bash↻ Restart☁ Manage files⌄ + ▣ New session✎ EditorOpen in VS Code for the Web + Web preview⌄⚙ Settings⌄? Help⌄ + + + Requesting a Cloud Shell.Succeeded. + Connecting terminal... + Welcome to Azure Cloud Shell + Type "az" to use Azure CLIType "help" to learn about Cloud Shell + Your Cloud Shell session will be ephemeral so no files or system changes will persist beyond your current session. + MOTD: You can now copy & paste in Cloud Shell using Ctrl+C/Ctrl+V (Linux/Windows) or Cmd+C/Cmd+V (Mac). + WARNING: TenantId ' + + hidden + ' contains more than one active subscription. Confirm the intended subscription. + WARNING: Confirm the intended Azure subscription before continuing. + Application: CYOT-CONSTO + PS ~/setup> Invoke-WebRequest 'https://raw.githubusercontent.com/.../Setup-Epp.ps1' -OutFile ./Setup-Epp.ps1 + PS ~/setup> ./Setup-Epp.ps1 + + diff --git a/docs/images/onboarding/key-vault-secrets.png b/docs/images/onboarding/key-vault-secrets.png index 9ec72ab..9e0ca64 100644 Binary files a/docs/images/onboarding/key-vault-secrets.png and b/docs/images/onboarding/key-vault-secrets.png differ diff --git a/docs/images/onboarding/logs-query-results.png b/docs/images/onboarding/logs-query-results.png index da30534..0c5bb00 100644 Binary files a/docs/images/onboarding/logs-query-results.png and b/docs/images/onboarding/logs-query-results.png differ diff --git a/docs/images/onboarding/monitoring-link.png b/docs/images/onboarding/monitoring-link.png index 372c287..821af88 100644 Binary files a/docs/images/onboarding/monitoring-link.png and b/docs/images/onboarding/monitoring-link.png differ diff --git a/docs/images/onboarding/monitoring-workspace.png b/docs/images/onboarding/monitoring-workspace.png index 97c640e..b02e6ab 100644 Binary files a/docs/images/onboarding/monitoring-workspace.png and b/docs/images/onboarding/monitoring-workspace.png differ diff --git a/docs/images/onboarding/resource-group.png b/docs/images/onboarding/resource-group.png index bf61c6c..ac2c37f 100644 Binary files a/docs/images/onboarding/resource-group.png and b/docs/images/onboarding/resource-group.png differ diff --git a/docs/images/onboarding/setup-choices.png b/docs/images/onboarding/setup-choices.png index b34cbaa..65e5f59 100644 Binary files a/docs/images/onboarding/setup-choices.png and b/docs/images/onboarding/setup-choices.png differ