Bring Your Own Cloud on Azure

With Bring Your Own Cloud (BYOC) on Azure, all the components that interact with your private data are deployed on your own Azure infrastructure and managed by the Paradime Control Plane via the Paradime Operator. This page provides step-by-step instructions for deploying Paradime BYOC on Azure.

​

Overall design

Paradime gains access to your Azure account via the Paradime Provisioner Enterprise App. It leverages a dedicated subscription where it creates a new Resource Group and bootstraps all the necessary infrastructure. At the center of the BYOC infrastructure are AKS clusters that provide compute resources for the Paradime data plane and all the workspaces you configure in the Paradime UI. These AKS clusters have a Paradime Operator installed in them that is connected to the Paradime Control Plane. The Paradime Operator receives instructions from the Control Plane and dynamically creates or destroys all the necessary Kubernetes resources required to support your Paradime workspaces.

​

Prerequisites

The bulk of the provisioning work is done remotely by Paradime automation. However, to get started, you need to provide Paradime with the necessary access along with some additional information:

• Azure Tenant ID: the Entra ID tenant of your Azure account
• Azure Subscription ID: a dedicated subscription that will exclusively host Paradime-managed infrastructure. This subscription boundary is the primary isolation mechanism: everything Paradime creates lives inside it, and the access you grant is scoped to it.
• Region: the target Azure region where Paradime BYOC will be installed
• Azure DNS zone: a public Azure DNS zone for the DNS name your Paradime deployment will live under (for example paradime.example.com), with delegation set up from your parent domain. The zone can live in the BYOC subscription or elsewhere in your tenant. Paradime creates DNS records for the application endpoints in this zone and uses it for TLS certificate validation. Pass the zone name, its resource group, and its subscription ID to your Paradime contact.

​

Provisioning access

​

Add the Paradime tenant to your organization

First, add the Paradime tenant to your organization. To do this, open the Azure Portal and go to Microsoft Entra ID -> External Identities -> Cross-tenant access settings -> Organizational Settings -> Add Organization. For Tenant ID, enter the Paradime tenant ID shared by your Paradime contact. Make sure that B2B Collaboration -> Inbound Access -> Applications is set to Allows access.

​

Register the Paradime service principal at your organization

To register the Paradime service principal for your organization, follow these steps:

1. Log in with an account that has permissions to register Enterprise applications.
2. Open a browser tab and go to the following URL, replacing <TENANT_ID> with your tenant ID and <PARADIME_PROVISIONER_CLIENT_ID> with the client ID shared by your Paradime contact: https://login.microsoftonline.com/<TENANT_ID>/oauth2/authorize?client_id=<PARADIME_PROVISIONER_CLIENT_ID>&response_type=code&redirect_uri=https%3A%2F%2Fwww.microsoft.com%2F
3. The Paradime service principal has specific credentials. Check that the following details match exactly what you see on the dialog box that pops up:

• Client ID: the client ID shared by your Paradime contact
• Name: paradime-byoc-provisioner

Once you have confirmed that all the information is correct, select Consent on behalf of your organization and click Accept.

​

Grant permissions on your BYOC Azure subscription to the paradime-byoc-provisioner

On the Azure Portal, go to Subscriptions -> your BYOC subscription -> Access control (IAM) -> Role Assignment and assign the following roles to the paradime-byoc-provisioner service principal:

• Contributor — allows Paradime to create and manage the data plane resources inside the dedicated subscription: the VNet and networking, AKS clusters and node pools, the PostgreSQL Flexible Server, Managed Redis, storage accounts, Azure NetApp Files, a Key Vault and its encryption keys, managed identities with federated (workload identity) credentials, private endpoints and private DNS zones, and the Azure AI Services account used for Paradime’s AI features. Because the subscription is dedicated to Paradime, Contributor here does not touch any other workload in your tenant.
• Role Based Access Control Administrator — Paradime assigns roles to the managed identities it creates so that workloads can reach their own resources. Use Azure’s delegated role assignment conditions to constrain what this grant can assign: when adding the role assignment, on the Conditions tab select Allow user to only assign selected roles and limit it to:
  • Storage Blob Data Contributor
  • DNS Zone Contributor
  These are the only roles Paradime automation assigns. With the condition in place, the provisioner cannot grant itself or anything else broader access.

​

Grant permissions on your DNS zone

The Paradime data plane publishes its application endpoints as records in your Azure DNS zone and delegates record management for certificate validation to a managed identity it creates. On the DNS zone (or its resource group), assign the paradime-byoc-provisioner service principal:

• Reader
• DNS Zone Contributor
• Role Based Access Control Administrator, constrained (as above) to assigning only DNS Zone Contributor

If the zone lives in a different subscription from the BYOC subscription, make these assignments there; the provisioner needs no other access outside the dedicated subscription.

​

Deployment

The actual deployment is done by Paradime automation. All that’s left to do is notify your Paradime contact at support@paradime.io that access has been granted, and pass along your Azure Tenant ID, Subscription ID, Region, and the DNS zone name with its resource group and subscription.