INSTALLATION WALKTHROUGH
Computer Logon Portal — Setup Guide
Step-by-step walkthrough of the desktop setup wizard, from signing in through a live, working portal — including granting other admins access and, later, repairing or removing a deployment.
Wizard version: v1.0.0 (219)
Platform: Windows desktop wizard
Audience: Tenant/subscription administrators
ON THIS PAGE
01 Sign in with Microsoft
02 Confirm the signed-in account
03 Select subscription
04 Select region
05 Email delivery configuration (optional)
06 Confirm the verified address
07 Review
08 Architecture preview & running cost
09 Setup progress
10 Set up administrators now, or later
11 Portal administrators
12 Assign a role — choose who
13 Assign a role — choose the level of access
14 Setup complete
PHASE 1
Sign in
The wizard signs in with a real Microsoft account and confirms it has the access the setup will need before touching anything in the tenant.
STEP 01
Sign in with Microsoft
The welcome screen lists what's needed before starting: an active Azure subscription, Owner (or Contributor plus role-assignment rights) on that subscription, and Global Administrator plus Attribute Definition Administrator in Microsoft Entra ID.
Click Sign in with Microsoft and authenticate as the account that will run the setup.
TIP "View permission details" expands the exact Azure and Entra permissions the wizard checks for — useful if a sign-in gets blocked later on a missing role. |
STEP 02
Confirm the signed-in account
Once authenticated, the wizard shows exactly which user and which Entra tenant it's about to operate against — a checkpoint before anything is created. Confirm this is the right tenant, then Continue.
PHASE 2
Choose where it's deployed
Three decisions before anything is created: which subscription pays for it, which Azure region hosts it, and — optionally — which mailbox delivers OATH token credentials to end users.
STEP 03
Select subscription
Pick the Azure subscription the portal will be provisioned into. A tenant can only ever host one Computer Logon Portal — if the selected subscription already has one, the wizard detects it here and offers to repair or manage it instead of creating a second one.
STEP 04
Select region
Only regions that currently support the full required architecture (Consumption-plan compute, Static Web Apps) are listed. This is a real deployment decision — data residency, latency to end users — so the wizard leaves it unselected rather than guessing on your behalf.
STEP 05
Email delivery configuration (optional)
If the portal will manage soft OATH tokens, this configures the mailbox used to email a token's QR code or installation link directly to end users. Enter an address and Verify, or Skip for Now — it can be configured later from inside the portal.
STEP 06
Confirm the verified address
Once verified, the address is shown with a confirmation that it will be used for credential delivery. Use Change to pick a different mailbox, or Continue to move on.
PHASE 3
Review & deploy
A final summary, a preview of exactly what gets created and what it costs to run, and then the live provisioning run itself.
STEP 07
Review
A single summary of every choice made so far — subscription, region, email delivery — each with its own Change/Configure shortcut back to that step. Begin Setup moves on to the architecture preview; nothing is created yet.
STEP 08
Architecture preview & running cost
Every Azure resource the run will create — resource group, Function App, storage account, Key Vault, Static Web App, and the app registration behind sign-in — with a one-line explanation of what each one is for.
The cost panel is priced live from Azure's own retail rates for the selected region, modeled against roughly 5,000 devices — not a flat estimate. Begin Setup starts real provisioning.
STEP 09
Setup progress
Every provisioning step runs in view, checked off as it completes. This typically takes several minutes — don't close the window while it's running. If it's ever interrupted, relaunching the wizard resumes from exactly where it left off.
PHASE 4
Set up administrators
The account that ran setup is automatically the first Administrator. This optional step grants portal access to anyone else who needs it, right after provisioning finishes.
STEP 10
Set up administrators now, or later
Provisioning succeeded. The signed-in account is already listed as Administrator. Set Up Administrators Now continues into the access screen below; Skip — Set Up Later in the Portal jumps straight to the finish screen — access can always be managed from inside the portal afterward.
STEP 11
Portal administrators
Shows everyone who currently has portal access — just the signed-in admin, on a fresh install. + Assign Role grants access to another user or group; searching and filtering work the same way here as inside the deployed portal itself.
STEP 12
Assign a role — choose who
Search across both Users and Groups, and select one or more — a single batch can mix both kinds. Selections are preserved even when switching tabs, so a group and an individual user can be granted the same role in one pass.
STEP 13
Assign a role — choose the level of access
Six roles cover full administration down to read-only viewing of just policies or just tokens. A principal already holding a broader role can't also be given a redundant narrower one — those options grey out with the reason shown inline.
PHASE 5
Done
The portal is live. This screen is also where a custom domain gets added later, whenever that's ready.
STEP 14
Setup complete
The portal's web address is ready to share with end users — Copy grabs it directly. A custom domain is entirely optional and can be added here or any time later by pointing a CNAME record at the generated address and clicking Configure Custom Domain.
Open Portal launches it in the browser; Install in Another Tenant signs out and restarts the wizard clean for a second deployment.