Deploy from Azure Marketplace
Corral deploys into your Azure tenant from the Azure Marketplace as a Managed Application. Expect 25 to 35 minutes, almost all of it unattended — you fill in a form, grant admin consent when the onboarding page asks for it, and watch the rest.
Prerequisites
- An Azure subscription with permission to create resources and to register resource providers
- The ability to grant admin consent for an Entra ID app registration (Global Admin, Application Admin, or Cloud Application Admin)
- A region that allows Azure Database for PostgreSQL on your subscription — the wizard works this out for you, and the Region list only offers regions Azure says yes to
What You’ll Do
1. Start the create wizard
Find Corral in the Azure Marketplace and click Create.
2. Basics
Choose the subscription and resource group, then fill in:
| Field | Notes |
|---|---|
| Instance Name | Names your instance and the URLs it is reached on |
| Region | The list is built by asking Azure which regions allow Azure Database for PostgreSQL on your subscription — see below if it comes back empty |
| Organization Name, Country Code, Industry | Required to accept the Azure Marketplace terms for the AI models Corral deploys |
| Primary Contact Email | Who we contact about the instance |
| Register providers | Tick this — it registers the Azure resource providers your subscription needs |
Two things about that page that catch people out:
- An empty Region list usually means the Azure Database for PostgreSQL provider is not registered yet, so the wizard cannot ask Azure which regions allow it. Tick Register providers, wait a minute, then untick and re-tick it to refresh. If the list is still empty, Azure allows none of Corral’s regions on this subscription — ask Azure support for an exception (issue type: Service and subscription limits).
- Bookmark the onboarding link. It appears on this page before you click Create, and it is how you follow the deployment afterwards.
3. Customization
- Resource Naming — an optional prefix and suffix added to the standard Azure naming abbreviations, if your organization has naming rules.
- Email Notifications — whether Corral may send system emails (for example billing alerts) from app@getcorral.ai. Changeable after deployment.
4. JIT Configuration
Set the just-in-time access policy that governs publisher access to the managed resource group. See Publisher Access & Maintenance →.
5. Review and create
Click Create. Once the managed application appears in your portal, the onboarding page starts tracking progress.
6. Follow the onboarding page
It walks you through each phase. Partway through it asks for admin consent for Entra ID — click through, grant it, and you are returned to the page.
7. Log in
When the page says the instance is deployed, open the admin console from it.
Why we ask for your organization’s details
Azure requires an organization name, country and industry before it will accept the Marketplace terms for Anthropic models in AI Foundry, and the assistants your instance creates run on one by default. Without those three values the deployment cannot create the model. They are stored in your own instance’s Key Vault.
What Happens Behind the Scenes
The deployment runs in phases. The onboarding page tracks each one in real time.
Pre-phase: Resource Provider Registration
The Register providers checkbox in the wizard registers the Azure resource providers your subscription needs before deployment begins. It is a step you take, not something that happens on its own — and registration is also what fills in the Region list.
Phase 1: Bootstrap & Azure Setup (2–3 minutes)
The marketplace ARM template deploys lightweight bootstrap resources: a managed identity, a Key Vault with deployment metadata, and connects the resource group. Once this phase starts, the onboarding tracking link becomes active.
Phase 2: App Registration Creation (minutes)
Creates the app registration for SSO authentication and configures access policies. Once this phase completes, admin consent becomes available on the onboarding page — click through to grant consent in Entra ID, and you’ll be redirected back to continue tracking.
Phase 3: Security Setup
Stores secrets and credentials in your instance’s Key Vault.
Phases 4–5: Infrastructure & Applications Deployment (the bulk of the time)
Deploys the full set of Azure resources into a managed resource group in your subscription, then deploys and configures the application containers — set up for future managed updates.
| Resource | Azure Service | Purpose |
|---|---|---|
| Managed Identity | User Assigned Managed Identity | Core identity for all services |
| Monitoring | Log Analytics Workspace | Centralized logging |
| Telemetry | Application Insights | Performance and usage telemetry |
| Secrets | Key Vault | Secrets, certificates, data protection keys |
| File Storage | Storage Account | State data, user files |
| Database | Azure Database for PostgreSQL (flexible server) | All operational data |
| Compute | Container Apps Environment | Hosts all application containers |
| AI Models | AI Foundry Hub + Project | Model deployments |
| Static Assets | Static Web App | CDN for embedded widgets and static files |
| Code Execution | Container Apps sandbox group | Sandboxed code execution for AI agents |
| Application Services | Container Apps (×5) | API server, Functions, document conversion, database migrations, Terraform runner |
Two notes on that list. Most of the variation in deployment time is the Container Apps environment, which takes 10 to 12 minutes in some regions and about 2 in others. And Static Web Apps exist in only a handful of Azure regions, so yours is created in the nearest one to the region you chose — everything that holds your data stays in your region.
Phase 6: Configuration & Finalization (seconds)
Updates redirect URIs with actual deployed URLs and completes final configuration. This phase reports only when it is finished, so it does not show a progress spinner.
After Deployment
Once provisioning completes (the onboarding page shows all phases as done):
Admin consent should already be complete — if you followed the onboarding page, you granted consent during Phase 2. If not, the onboarding page still provides the consent link.
Log in: Click the admin console link on the onboarding page. Sign in with your organizational account. You’ll land as the first user with full permissions.
Start using it: See Your First 30 Minutes → for what to do next.
Troubleshooting
- The Region list is empty. The PostgreSQL resource provider is not registered yet — see step 2 above.
- “Deployment Issue” appears immediately. That instance name already has a deployment record against this subscription. Pick another name, or delete the earlier managed application and wait for the record to clear.
- Sign-in fails for a few minutes after the page says the instance is ready. Entra takes a short while to accept the new instance’s redirect URI. Wait a couple of minutes and try again.