Deploy Logic Foundry and the Logic Agents

This template deploys Logic Foundry and the six Logic Agents (Assist, Assurance, Context, Guard, Insights and Sentinel) together, already connected: each agent signs users in and works with Logic Foundry on their behalf. Check the prerequisites first.

What gets deployed

Resource	Count	Notes
Container Apps environment	1	Shared by everything below.
Logic Foundry container app	1	The MCP server that AI clients and the agents connect to.
Logic Agents container apps	6	One web app per agent.
Internal cache (Redis) container app	1	Keeps the agents’ working state, such as running jobs. Reachable only inside the environment.
Storage account	1	Keeps the cache’s data across restarts.
Managed identities	7	One per product.
App registrations in Microsoft Entra ID	8	Logic Foundry, a client for desktop AI tools, and one per agent.
Dataverse application user	1	For Logic Foundry’s managed identity, with the Flowon Customizer role. The agents reach Dataverse only through Logic Foundry.
Application Insights and Log Analytics	0 or 1	Created unless you reuse an existing resource or turn it off.

Deploy

1. Get the template from the Logic Fabric deployment templates, which Flowon provides on request (contact Flowon) and open a terminal in its foundry folder.

2. Create an azd environment. Use a name that says which Dataverse environment it serves, for example lf-ai-prod:

   azd env new lf-ai-prod

   azd asks for the Azure subscription and region.

3. Set the two required values:

   azd env set dataverseUrl "https://contoso.crm.dynamics.com/"
   azd env set setupManagedIdentityId "<resource ID of your setup identity>"

4. Connect the agents to an AI model. For the default provider (Claude on Azure AI Foundry):

   azd env set azureFoundryAnthropicEndpoint "https://<your-resource>.services.ai.azure.com/anthropic"
   azd env set azureFoundryAnthropicModel "<deployment name>"
   azd env set azureFoundryAnthropicApiKey "<key>"

   For other providers, see AI model.

5. Deploy:

   azd provision

   It creates the resources in order; the first deployment takes longer than later updates.

6. Get the addresses:

   azd env get-values

   CONTAINER_APP_URL is the Logic Foundry address. AGENT_APPS lists each agent with its containerAppUrl.

First deployment into a new environment

Microsoft Entra ID can take a moment to make new app registrations visible. If the first azd provision fails with “The language expression property ‘appId’ doesn’t exist” or “Request_ResourceNotFound”, run azd provision again. The registrations were created; the second run finishes the remaining steps. Later deployments don’t hit this.

After deployment

1. Give users the addresses. Designers add the Logic Foundry address to their AI client (see Set up Logic Foundry). Each agent’s address opens its web app.
2. Decide who can use the products. Users sign in with their organization account. To limit access to a group, open each app registration’s enterprise application in Microsoft Entra ID, turn on Assignment required, and assign the group.
3. Check the agents. Open one agent, sign in and run a small task against a development project.

AI model

The agents need an AI model. Choose one provider with llmProvider and set only that provider’s values.

llmProvider	Service	Required values	Optional values (defaults)
AzureFoundryAnthropic (default)	Claude models on Azure AI Foundry	azureFoundryAnthropicEndpoint, azureFoundryAnthropicApiKey, azureFoundryAnthropicModel	azureFoundryAnthropicVersion (2023-06-01)
AzureFoundry	Other models on Azure AI Foundry	azureFoundryEndpoint, azureFoundryApiKey, azureFoundryModel	—
AzureOpenAI	Azure OpenAI Service	azureFoundryOpenAIEndpoint, azureFoundryOpenAIApiKey, azureFoundryOpenAIModel	—
OpenAI	OpenAI	openAIApiKey, openAIModel	—
Anthropic	Anthropic	anthropicApiKey, anthropicModel	anthropicVersion (2023-06-01)

Set them with azd env set, for example azd env set llmProvider AzureOpenAI. Keys are stored as secrets of the container apps, not in the template. The same model serves all agents and all projects.

Request time-outs and output limits (…TimeoutMinutes, default 10; …MaxOutputTokens, default 16384) and the number of simultaneous model requests per agent (llmMaxConcurrency, default 4) are set in infra/main.parameters.json (add llmMaxConcurrency there if you want to change it).

Settings

Set these with azd env set <name> <value> before azd provision. Settings marked file only take effect in infra/main.parameters.json: change their value there, or add them if they aren’t listed yet, for example:

"agentLogLevel": {
  "value": "Information"
}

Setting	Default	What it does
dataverseUrl	— (required)	The Dataverse environment Logic Foundry works with.
setupManagedIdentityId	— (required)	Resource ID of your setup identity.
dataverseSecurityRoleName (file)	Flowon Customizer	Security role given to Logic Foundry’s application user. Must exist in the environment.
acaNamePrefix	flowon-logic-fabric	Prefix for all resource names, for example flowon-logic-fabric-guard-agent.
appInsightsConnectionString	(empty: create new)	Reuse an existing Application Insights resource, or DISABLED to turn monitoring off.
agentLogLevel (file)	Critical	How much the agents log. Use Information or Warning while troubleshooting.
entraAppServerDisplayName	Flowon Logic Fabric Foundry MCP Server	Name of Logic Foundry’s app registration.
entraAppClientDisplayName	Flowon Logic Fabric Foundry MCP Client	Name of the desktop-client app registration.
entraAppClientId	(empty: create new)	Reuse an existing desktop-client app registration.
agentEntraAppIds (file)	{}	Reuse existing agent app registrations, for example { "guard": "<app id>" }.
serviceManagementReference (file)	(empty)	Links the app registrations to a service in your tenant’s app catalog.
foundryCustomDomain	(empty)	Custom domain for Logic Foundry. See below.
agentCustomDomains (file)	{}	Custom domain per agent, for example { "guard": "guard.contoso.com" }.

Custom domains

By default each product gets an …azurecontainerapps.io address. To use your own domain, for example foundry.contoso.com, Azure issues a free certificate once DNS points at the app:

1. Deploy once without the custom domain, and note the app’s default address (azd env get-values).
2. In your DNS, add a CNAME record for the domain that points at that default address.
3. Add a TXT record named asuid.<your domain> with the value of CUSTOM_DOMAIN_VERIFICATION_ID from azd env get-values. The same value works for every domain in this deployment.
4. Set the domain (azd env set foundryCustomDomain foundry.contoso.com, or add the agent to agentCustomDomains in infra/main.parameters.json) and run azd provision again.

If DNS hasn’t updated yet, certificate creation fails; run azd provision again later. An agent’s custom domain is also added to its sign-in settings, so both addresses keep working.

Update

The template always deploys the latest published release of each product. To move to a newer release:

1. Get the latest template and run azd provision from the same azd environment. Your settings, app registrations and cache password are kept.
2. Restart each container app so it starts on the new release: in the Azure portal, open the container app, go to Revisions and replicas, and select Restart on the active revision.

Remove

azd down --purge

This deletes the resource group and everything in it. It does not delete the app registrations in Microsoft Entra ID. To remove them too, delete them afterwards (their IDs are in azd env get-values: ENTRA_APP_SERVER_CLIENT_ID, ENTRA_APP_CLIENT_CLIENT_ID and each agent’s entraAppClientId):

az ad app delete --id <app id>

If you plan to deploy again, you can keep them and reuse them with entraAppClientId and agentEntraAppIds.

Troubleshooting

Problem	What to do
Tool calls fail with AADSTS65001 (consent required)	Admin consent for Dynamics 365 access is missing. Run azd provision with an account that has Global Administrator or Privileged Role Administrator, or grant it yourself: Microsoft Entra ID > App registrations > Logic Foundry’s app > API permissions > Grant admin consent.
azd provision fails while creating the Dataverse application user	The setup identity doesn’t have System Administrator in this environment, or dataverseSecurityRoleName doesn’t match a role there. Fix it and run azd provision again. If the error says a resource “already exists or is in a conflicting state”, delete the failed dataverse-application-user-setup resource from the resource group first.
The first azd provision fails with “property ‘appId’ doesn’t exist”	Run azd provision again (see the note above).
Certificate or domain validation errors	DNS for the custom domain hasn’t updated yet. Wait and run azd provision again.
An agent’s sign-in fails after adding a custom domain	Run azd provision again; it registers the new address for sign-in.
Agents answer with model errors	Check llmProvider and that provider’s endpoint, model and key, then run azd provision.

Related

• Deploy the AI products: prerequisites and the setup identity
• Deploy Logic Conductor
• Set up Logic Foundry
• Logic Agents