The Azure Gateway Provisioner is a browser-based wizard that creates a complete Azure API proxy infrastructure for the Auvik network monitoring platform — without requiring the Azure CLI, PowerShell, Bicep, or Terraform. An engineer opens the HTML file, signs in with their Microsoft account, fills out a configuration form, and clicks Provision. The tool then calls the Azure Resource Manager API directly from the browser to deploy seven Azure resources in sequence.

The end result is a secure Azure Function App that sits between your MSP dashboards and the Auvik API. Auvik credentials never appear in browser code after provisioning — they are stored encrypted in Azure Key Vault and injected server-side on every request.

The provisioner creates a three-layer security architecture. The browser never touches the Auvik API directly after provisioning. Every request flows through the Function App, which reads credentials from Key Vault at runtime using its Managed Identity.

Before the provisioner can sign in with your Microsoft account, Azure needs to know this application exists. You register it once in Entra ID (Azure AD) and paste the resulting IDs into the form. This step takes about 3 minutes in the Azure Portal.

After entering valid GUIDs for both fields and clicking Save & Continue, the provisioner initializes the MSAL instance and advances to Step 2. The step indicator turns green and shows a checkmark.

Click Sign In with Microsoft. A Microsoft login popup opens. Sign in with a work account that has at least Contributor rights on the Azure subscription you want to provision into. Contributor is the minimum required role — Owner is needed only if you also need to assign RBAC roles, which this provisioner does not do.

On successful login the page shows your account name, email, initials badge, and a subscription dropdown populated from your Azure account. Select the target subscription and click Configure Resources to advance to Step 3.

Step 3 is the configuration form. All fields have defaults pre-filled. Review each value before clicking Provision Gateway Server.

Clicking Provision Gateway Server advances to Step 4 and begins the automated deployment. A real-time terminal output window shows every ARM API call, its result, and the generated resource URLs. A progress bar tracks overall completion across seven operations.

Total provisioning time is typically 3–8 minutes depending on Azure region latency and resource creation queues. The Function App creation step (Step 4/7) takes the longest — Azure provisions the consumption plan and registers the runtime before returning.

Step 5 confirms all resources were created successfully and shows six result cards with all generated URLs and resource names. Each value has a copy button. This is the screen to screenshot for your deployment record.

The page also shows a before/after code snippet for updating any Auvik console dashboards to use the proxy URL instead of the direct Auvik endpoint. See Section C5 for the full update process.

The Run Health Check button calls the /api/health endpoint and shows the raw JSON response. Note that this will return a 404 or connection error until the Function App code is deployed separately — the provisioner creates the Azure infrastructure but does not deploy the Node.js function code. See Section C4.

These are the app settings written to the Function App by the provisioner. Settings marked as KV Reference never contain the actual secret value — Azure resolves them at runtime using the Function App's Managed Identity.

This is done once in the Azure Portal before opening the provisioner for the first time. All steps below are in Entra ID (Azure Active Directory).

• 1
  Navigate to App registrations.Azure Portal → search "App registrations" → click New registration.
• 2
  Set the name.Use cyberadvisers-provisioner or a name that clearly identifies the tool. This appears in your Entra ID app list.
• 3
  Set supported account types.Select "Accounts in this organizational directory only (Single tenant)." Do not select multi-tenant unless you are provisioning across multiple Azure AD tenants.
• 4
  Set the redirect URI.Select type: Single-page application (SPA). Enter the URL where the provisioner HTML file will live. If testing locally: http://localhost. If hosted on SharePoint: https://TENANT.sharepoint.com/sites/SITE/Shared%20Documents/azure-provisioner.html
• 5
  Click Register.The app registration is created. You land on the Overview page.
• 6
  Copy the IDs.Copy both the Application (client) ID and the Directory (tenant) ID from the Overview page. These go into the provisioner's Step 1 form fields.
• 7
  Add API permission.In the app registration, go to API permissions → Add a permission → Azure Service Management → Delegated permissions → select user_impersonation → Add permissions.
• 8
  Grant admin consent.Still on the API permissions page, click "Grant admin consent for [your organization]" and confirm. The permission status changes to a green checkmark. Without this step the login popup will show a consent screen on every sign-in.

The provisioner is a single self-contained HTML file with one CDN dependency (MSAL.js from Cloudflare CDN). Deploy it anywhere that serves HTML over HTTPS.

The provisioner creates the Azure infrastructure but does not deploy the Node.js function code. The Function App is live in Azure but will return a 404 on all routes until you push code to it. You need the Azure Functions Core Tools installed locally.

• 1
  Install Azure Functions Core Tools.npm install -g azure-functions-core-tools@4 --unsafe-perm
• 2
  Create your function project locally.func init my-proxy --worker-runtime node --language javascript
• 3
  Create the proxy function.func new --name auvik --template "HTTP trigger". Then write the proxy logic: read AUVIK_BASE_URL, AUVIK_API_USER, AUVIK_API_KEY from process.env, build the Basic auth header, forward the request, and return the response. Add CORS headers using the ALLOWED_ORIGIN env var.
• 4
  Create the health function.func new --name health --template "HTTP trigger". Return a JSON object showing KV secret resolution status (check that env vars are non-empty) and an Auvik API ping result.
• 5
  Sign in to Azure CLI.az login and az account set --subscription {your-subscription-id}
• 6
  Publish to the Function App.func azure functionapp publish {your-funcapp-name}. This deploys the code to the Function App created by the provisioner. After a minute the proxy endpoint will respond to requests.

Once the Function App is live and the health check passes, update any Auvik console HTML pages that call the Auvik API directly. The change is minimal — swap the base URL and remove the Authorization header.

The proxy endpoint mirrors the Auvik API path structure. Any call that previously went to https://auvikapi.us1.my.auvik.com/v1/inventory/network/devices now goes to https://{funcapp}.azurewebsites.net/api/auvik/inventory/network/devices. Path, query parameters, and response format are identical.

• ✓
  Step 1 completes with green checkmark. If you see "MSAL init error", the Tenant ID or Client ID is wrong — verify both GUIDs in the Azure Portal app registration Overview page.
• ✓
  Sign-in popup opens and returns to the page. If the popup opens but the page doesn't update, the redirect URI in the app registration doesn't match the current page URL. Update Authentication → Redirect URIs in the app registration to match exactly.
• ✓
  Subscription dropdown populates. If it stays empty, the ARM token didn't include the right scope. Verify the app registration has Azure Service Management → user_impersonation with admin consent granted.
• ✓
  Terminal reaches 100% with all ✓ green lines. Any red error line means a provisioning step failed. Read the error body — it contains the ARM error code and message.
• ✓
  Resource Group appears in Azure Portal. Go to portal.azure.com → Resource groups → search for your RG name. All five resources (storage, key vault, consumption plan, function app, and function app plan) should be inside it.
• ✓
  Key Vault secrets exist. Azure Portal → Key Vault → Secrets → confirm auvik-api-user and auvik-api-key are present and show as Enabled.
• ✓
  Function App Managed Identity is On. Azure Portal → Function App → Identity → System assigned → Status shows On. If Off, the KV references will not resolve and the proxy will fail to read credentials.
• ✓
  Health check returns JSON after function code deploy. Click Run Health Check in Step 5. Should return a JSON object. A 404 means code hasn't been deployed yet. A 500 with "KeyVault" in the message means the access policy wasn't applied — check that the Function App's principalId has get-secrets permission on the vault.