Deploy Logic Conductor

This template deploys Logic Conductor on its own, for one Dataverse environment. Conductor turns the logic blocks, logic flows and business processes that designers mark with Expose as MCP Tool into tools for AI assistants (see Logic Conductor). Check the prerequisites first. Conductor doesn’t need an AI model.

What gets deployed

Resource	Count	Notes
Container Apps environment	1
Logic Conductor container app	1	The MCP server AI clients connect to.
Managed identity	1	Conductor uses it to read which tools to offer when it starts.
App registrations in Microsoft Entra ID	2	Logic Conductor, and a client for desktop AI tools.
Dataverse application user	1	For Conductor’s managed identity, with the Flowon Customizer role.
Application Insights and Log Analytics	0 or 1	Created unless you reuse an existing resource or turn it off.

Tool calls run with the signed-in user’s own Dataverse permissions. The managed identity is only used to discover the tools.

Deploy

1. Get the template from the Logic Fabric deployment templates, which Flowon provides on request (contact Flowon) and open a terminal in its conductor folder.

2. Open infra/main.parameters.json and set the projects Conductor exposes, separated by commas or semicolons, exactly as the project names appear in Logic Fabric:

   "flowonProjects": {
     "value": "Sales;Service"
   }

   With no project, Conductor offers no tools. Set the other values in this file now too if you need them (see Settings).

3. Create an azd environment, for example lf-conductor-prod, and choose the subscription and region when asked:

   azd env new lf-conductor-prod

4. Set the two required values:

   azd env set dataverseUrl "https://contoso.crm.dynamics.com/"
   azd env set setupManagedIdentityId "<resource ID of your setup identity>"

5. Deploy:

   azd provision

6. Get the address. CONTAINER_APP_URL in the output of azd env get-values is the Logic Conductor address.

First deployment into a new environment

If the first azd provision fails with “The language expression property ‘appId’ doesn’t exist” or “Request_ResourceNotFound”, run azd provision again. Microsoft Entra ID sometimes needs a moment before new app registrations are visible; the second run finishes the deployment.

After deployment

1. Give designers the address. They add it to their AI client; see Set up Logic Conductor.
2. Decide who can use it. Users sign in with their organization account. To limit access, turn on Assignment required on Conductor’s enterprise application in Microsoft Entra ID and assign a group.
3. Restart after tool changes. Conductor reads the list of tools when it starts. When designers add, rename or remove tools, restart the container app (Azure portal > the container app > Revisions and replicas > Restart).

Settings

Set the two required values with azd env set. Set everything else in infra/main.parameters.json: change the value if the setting is listed there, or add it, for example "dataverseSecurityRoleName": { "value": "<role name>" }.

Setting	Default	What it does
dataverseUrl	— (required, azd env set)	The Dataverse environment Conductor works with.
setupManagedIdentityId	— (required, azd env set)	Resource ID of your setup identity.
flowonProjects	(empty: no tools)	The projects whose exposed artifacts become tools. Adding a second project adds the project name to every tool name.
acaName	flowon-logic-fabric-conductor-mcp	Name of the container app; also the prefix for the other resource names. At most 32 characters.
dataverseSecurityRoleName	Flowon Customizer	Security role given to Conductor’s application user. Must exist in the environment.
appInsightsConnectionString	(empty: create new)	Reuse an existing Application Insights resource, or DISABLED to turn monitoring off.
entraAppServerDisplayName	Flowon Logic Fabric Conductor MCP Server	Name of Conductor’s app registration.
entraAppClientDisplayName	Flowon Logic Fabric Conductor MCP Client	Name of the desktop-client app registration.
entraAppClientId	(empty: create new)	Reuse an existing desktop-client app registration.
serviceManagementReference	(empty)	Links the app registrations to a service in your tenant’s app catalog.
customDomain	(empty)	Custom domain, for example conductor.contoso.com. See below.

Custom domain

1. Deploy once without the custom domain, and note the default address (CONTAINER_APP_URL).
2. In your DNS, add a CNAME record for the domain pointing at that address, and a TXT record named asuid.<your domain> with the value of CUSTOM_DOMAIN_VERIFICATION_ID from azd env get-values.
3. Set customDomain in infra/main.parameters.json and run azd provision again.

If DNS hasn’t updated yet, certificate creation fails; run azd provision again later.

Update

The template always deploys the latest published release. To move to a newer release, get the latest template, run azd provision from the same azd environment, then restart the container app (Revisions and replicas > Restart).

Remove

azd down --purge

This deletes the resource group and everything in it, but not the two app registrations. Delete them afterwards with az ad app delete --id <app id> (the IDs are ENTRA_APP_SERVER_CLIENT_ID and ENTRA_APP_CLIENT_CLIENT_ID in azd env get-values), or keep them to reuse with entraAppClientId if you deploy again.

Troubleshooting

Problem	What to do
No tools appear	flowonProjects is empty or a name doesn’t match a project; the artifacts don’t have Expose as MCP Tool turned on; or Conductor hasn’t been restarted since the change.
Tool calls fail with AADSTS65001 (consent required)	Run azd provision with an account that has Global Administrator or Privileged Role Administrator, or grant consent yourself: Microsoft Entra ID > App registrations > Conductor’s app > API permissions > Grant admin consent.
Conductor doesn’t start and its log shows a Dataverse sign-in error	Its application user wasn’t created or its role is too limited. Check the setup identity and dataverseSecurityRoleName, then run azd provision again.
azd provision fails while creating the Dataverse application user	The setup identity doesn’t have System Administrator in this environment, or the role name doesn’t exist there. Fix it and run azd provision again. If the error says a resource “already exists or is in a conflicting state”, delete the failed dataverse-application-user-setup resource from the resource group first.
Certificate or domain validation errors	DNS hasn’t updated yet. Wait and run azd provision again.

Related

• Deploy the AI products: prerequisites and the setup identity
• Deploy Logic Foundry and the Logic Agents
• Set up Logic Conductor
• How Logic Conductor works