Skip to main content

For Azure users

If you are experienced with Microsoft Azure, this guide translates Azure service vocabulary, security concepts, and deployment models into Crusoe AI Platform terminology.

While Azure often requires upfront configuration decisions—such as selecting hosting plans, pricing tiers, and virtual network subnet delegates—Crusoe AI Platform provides a streamlined experience where services deploy instantly with built-in networking and security defaults.

Vocabulary Translation​

Azure Service / ConceptCrusoe AI PlatformKey Distinctions
Entra ID TenantOrganizationSingle organizational scope owning projects and user accounts.
Subscription & Resource GroupProjectSingle unified workspace boundary for resources, access control, quota limits, and audit logs.
Subscription ID & Resource Group NameProject Slug & Short IDHuman-readable slug (ml-team) and permanent short ID (ab12cd) used in workload network addresses.
Entra RBAC Role (Contributor, Reader)Project Role: admin or memberStreamlined access model (admin or member) eliminating complex custom role definitions.
Azure PortalWeb ConsoleWeb management portal at https://console.codyhill.dev. See Create an Account.
Azure CLI (az) & azdplatformctlUnified CLI binary for agents, functions, container services, messaging, and data stores. See Install CLI.
Service Principal / Managed IdentityService AccountProject-scoped machine identity (name@<project-short>.cai.local) holding project roles.
Client Secret / CertificateAPI Key (cai_<keyid>_<secret>)Single-reveal API key generated for service accounts with instant revocation capabilities. See Service Accounts.
Entra Token AcquisitionAuthorization: Bearer <key>Direct API key header authentication without requesting OAuth tokens from MSAL endpoints.
Container Apps EnvironmentProject BoundaryProject boundaries isolate network traffic automatically without requiring managed environment resources.
Azure Container AppsServerless ServiceDirect container-to-HTTPS deployment with automatic scale-to-zero execution.
Container Apps RevisionRevisionImmutable snapshot of code and configuration created on every deploy, supporting traffic splitting. See Revisions.
Container Apps Scale Rules (KEDA)Autoscaling & Min InstancesBuilt-in scale-to-zero autoscaling with optional min instances for zero cold-start latency. See Autoscaling.
Ingress FQDN (*.azurecontainerapps.io)Built-in HTTPS URLAutomatic HTTPS address assigned to every deployed service (https://<name>-<project-short>.apps.codyhill.dev).
Azure FunctionsFunctionEvent-driven serverless code exposing handle(event) across Python, Node.js, Go, and Ruby runtimes.
Hosting Plan (Consumption, Flex)Unified Serverless ExecutionSingle serverless execution engine with no complex plan selection required.
Azure AI Foundry Agent ServiceAgentsServerless AI agent execution for ADK, LangGraph, or CrewAI frameworks with built-in state management.
Foundry ThreadSessionsNative conversation context management replayed automatically to models on each invocation turn.
Foundry RunAgent InvocationSingle execution call to an agent endpoint via the API or platformctl invoke. See Invoke.
Container Apps Dynamic SessionsCode SandboxEphemeral, isolated container sandbox executing untrusted code securely per invocation.
Azure AI Search Vector StoreVectorDB IndexDedicated high-performance vector database using HNSW indexing and payload filtering.
Azure Managed RedisMemoryStoreManaged in-memory key-value store speaking standard Redis wire protocol.
Service Bus Queue / TopicPub/Sub Topic & SubscriptionsUnified messaging service providing point-to-point queues and pub/sub fan-out subscriptions.
Event GridPub/SubSingle unified event messaging service eliminating multiple overlapping event services.
Durable FunctionsPub/Sub Chains / Agent OrchestrationMulti-step workflows orchestrated via Pub/Sub event sequences or AI agent tool chains.
Azure Key VaultSecrets ManagerProject-scoped secret management with numbered version history injected directly into workloads.
Azure Monitor & Log AnalyticsLogsReal-time log streaming with 14-day persistent history surviving container scaling.
Activity LogProject Audit LogAlways-on management operations auditing recorded automatically for all project members.
Subscription QuotasProject QuotasReal-time resource quota tracking providing clear capacity bounds without complex billing sub-SKUs.
M365 Copilot AgentEmbed ChatTurnkey web chat widget embeddable on any website with domain allowlisting.

Key Similarities​

  • Immutable Revisions: Deploying creates an immutable revision snapshot, enabling safe traffic splitting and instant rollbacks—matching Container Apps revision lifecycles.
  • Scale-to-Zero Compute: Workloads pause when idle and wake instantly on demand, mirroring Container Apps scale-to-zero behavior.
  • Thread and Session Model: Managing conversation state using session identifiers matches Azure AI Foundry thread and run concepts.
  • Role-Based Machine Identities: Service accounts function as project-scoped identities holding roles and authenticating via API keys.

Architectural Distinctions​

Platform Streamlining​

  • Zero Upfront Plan Decisions: Deploy immediately without selecting hosting plans, capacity tiers, or subnet delegations.
  • Single Standard Authorization Header: Authenticate directly with Authorization: Bearer <key>—no MSAL libraries or token endpoints needed.
  • Unified Messaging Model: A single Pub/Sub service handles both point-to-point queuing and fan-out notifications.
  • Built-in HTTPS Endpoints: Every function, agent, and service receives a public HTTPS URL upon deployment.
  • Ephemeral Sandbox Execution: Code Sandbox instances run in isolated single-use containers destroyed upon completion, preventing cross-tenant residue.

Azure Migration Considerations​

  • Single-Region High Efficiency: Compute resources operate in high-density, low-latency environments optimized for fast execution and inference.
  • Workflow Orchestration: Multi-step workflows utilize Pub/Sub event chains or AI agent tool sequences to orchestrate steps.
  • Secret Lifecycle: Updating a secret creates a new version and automatically updates attached workload revisions.

Hands-On: Manage Secrets Without Provisioning a Vault​

On Azure, storing a secret requires first provisioning a Key Vault resource. On Crusoe AI Platform, secrets belong directly to your project. Using platformctl or the HTTP API:

export CAI_API="https://api.codyhill.dev"
export CAI_PROJECT="your-project-id"

curl -s -X POST "$CAI_API/v1/projects/$CAI_PROJECT/secrets" \
  -H "Authorization: Bearer <your-api-key>" \
  -H "Content-Type: application/json" \
  -d '{"name":"openai-api-key","value":"sk-..."}'

Response (201 Created):

{
  "name": "openai-api-key",
  "version": 1,
  "created": true
}

Updating the secret with a new value automatically creates version 2. See Manage Secrets.

Workload Migration Guide​

Azure WorkloadCrusoe AI Platform Destination
Azure Container AppsServerless Overview and Autoscaling
Azure FunctionFunction Quickstart and Runtimes
Azure AI Foundry AgentAgent Quickstart and Agent Deployment
Foundry Threads & RunsSessions and Invoke
Azure AI Search Vector StoreVectorDB Quickstart and Search
Azure Managed RedisMemoryStore Quickstart
Service Bus Queues & TopicsPub/Sub Quickstart and Publish & Consume
Durable FunctionsPub/Sub Event Chains or Agent Tool Pipelines
Container Apps Dynamic SessionsCode Sandbox and Security & Limits
Key Vault SecretsManage Secrets and Use Secrets in Workloads
Entra Roles & Managed IdentitiesProjects & Access and CI/CD Service Accounts

Next Steps​