PSI Knowledge Base

azure-resources

10 min readEdit this page

Azure Resource Map

Complete mapping of Azure resources to GitHub repositories, including app registrations, deployment identity patterns, runners, and resource groups.

Repository → Azure Resource Map

The master reference for which Azure resources belong to each GitHub repository.

RepositoryAzure ResourceResource TypeResource GroupCustom DomainApp Registration
PSI.UniData.API—On-prem (PS-PROXY)—api.progressivesurface.comPSI.UniData.API
psi-explorer-webbom-explorer-webApp Service (Linux)PS-WEBAPPSexplorer.progressivesurface.comPSI PSI Explorer
redbook-webredbook-webApp Service (Linux)PS-WEBAPPSredbook.progressivesurface.comPSI-Redbook-Web
psi-portalpsi-portalApp Service (Linux)PS-WEBAPPSportal.progressivesurface.comPSI Portal
project-explorerps-project-explorerApp Service (Linux)PS-WEBAPPSprojects.progressivesurface.comPSI Project Explorer
erp-migration-toolerp-migration-apiApp Service (Linux)PS-WEBAPPSdmt.progressivesurface.comPSI ERP Migration Tool
PRGJSMESprgjsmes-prodApp Service (Windows)PS-WEBAPPSpsmes.progressivesurface.comPRGJSMES
progressive-data-viewps-progressive-viewApp Service (Linux)PS-WEBAPPS——
redbook-dashboardps-redbook-dashboardApp Service (Linux)PS-WEBAPPSquality.progressivesurface.comPSI Redbook Dashboard
PSI-Wiki-Sitepsi-wikiStatic Web AppPS-WEBAPPSwiki.progressivesurface.comPSI Wiki
redbook-photospsredbookphotosApp Service (Node 20)PsRedbookPhotos——
shipping-photosps-shipphotosApp Service (Node 24)PS-RG-01——
psi-nfc-launcherpsi-tap-bridgeFunction App (Linux)PS-WEBAPPS—PSI TAP Bridge
argo-analyticsps-argo-analyticsApp Service (Linux)PS-WEBAPPSargo.progressivesurface.com—
psi-winget-sourceps-winget-sourceApp Service (Linux/Docker)PS-WEBAPPSpackages.progressivesurface.comPSI WinGet Source
psi-winget-sourcepsiwingetpkgsStorage AccountPS-WEBAPPS——
psi-winget-sourcepsicontainersContainer Registry (Basic)PS-WEBAPPSpsicontainers.azurecr.io—
csm-boardcsm-boardApp Service (Linux)PS-WEBAPPSboard.progressivesurface.comCSM Board
ZebraTrackingpsi-zebra-trackingApp Service (Linux, .NET 8)PS-WEBAPPS——
psi-data-pipelinepsi-datasyncApp Service (Linux)PS-WEBAPPS——
psi-nfc-launcherpsi-notify-listenerFunction App (Linux)PS-WEBAPPS——
procisely-redirectprocisely-redirectApp Service (Linux)PS-WEBAPPSprocisely.com—
(TBD)ps-dispatchApp Service (Linux, .NET 8)PS-WEBAPPS——
build-vs-buy 🚧ps-buildvsbuyApp Service (Linux)PS-WEBAPPS— (default host only)—

🚧 ps-buildvsbuy is new (June 2026) and under active development — not yet hardened. Its PE ps-buildvsbuy-pe exists (10.160.140.5) but public access is still enabled and httpsOnly is off. Pre-launch hardening checklist is in azure-security.

Entra ID App Registrations

Each web app has an App Registration in Microsoft Entra ID for authentication. Some repos also have a separate service principal or managed identity deploy path for GitHub Actions.

Application Registrations

App RegistrationApplication (Client) IDMaps to RepositoryPurpose
PSI.UniData.APIb3db69d9-5d15-457d-b660-88b336fc00faPSI.UniData.APIAPI auth
PSI PSI Explorer13d6930a-97d9-4a8d-b355-a31074fbd53dpsi-explorer-webClient/app-layer auth
PSI-Redbook-Web85a9ca9b-2bdf-4c68-b115-24d14ad55f43redbook-webClient/app-layer auth
PSI Redbook Dashboard294f8c40-a7bd-4a26-9888-ab49987582b4redbook-dashboardEasyAuth + app-layer
PSI Project Explorer971a34d6-004c-40c0-86d9-f610d83a26caproject-explorerClient/app-layer auth
PSI Portal7f929c7f-2483-4206-93b6-11225e07ca85psi-portalClient/app-layer auth
PSI ERP Migration Tool55dae93e-2df7-46fd-b677-01c384d22394erp-migration-toolClient/app-layer auth (platform auth disabled)
PSI Wiki9f4f895d-d74d-46df-a04a-febfc52fbf34PSI-Wiki-SiteSWA auth
PRGJSMESe52f5171-93ba-4e68-b4a7-3ba1409cda09PRGJSMESClient/app-layer auth
PSI TAP Bridge11d892e3-e20b-4fb2-aef7-6f9b37d02cb6psi-nfc-launcherGraph API (client credentials)
PSI WinGet Sourceb0b01ac6-8f1f-4b55-af50-c582da3dfd77psi-winget-sourceWinGet REST API auth (Entra ID + pre-authorized WinGet client)
CSM Board9eeff376-82ba-40cf-a4b9-d2ed4970d82dcsm-boardSPA auth (MSAL.js PKCE) for the hosted Claude Work Board; isFallbackPublicClient: true so the per-developer csm agent can use device-code flow against the same app reg

Deployment Service Principals

These are used by GitHub Actions for az webapp deploy via federated credentials or client secrets.

Service PrincipalApplication IDDeploys to Repository
github-deploy-progressive-view7b2e8877-75a6-46a8-b3b4-6f29d9678993progressive-data-view
psi-portal-deploy15237620-9676-4701-b912-fef07a31a162psi-portal
prgjsmes-github-deploy8a999858-747c-406e-a69f-1e2c4efb1d24PRGJSMES

Tenant ID: a83ae943-0a50-49cc-83c3-479b7a44b7fb

GitHub Actions Deployment Secrets

Deployment auth posture was standardized in April 2026:

  • App Service production deploys: identity-based (az login --identity on self-hosted runner, or Entra federated credentials)
  • Static Web App deploys: SWA API token
  • Publish profile deploys: deprecated for production App Services
PatternTypical Secret/ConfigNotes
App Service (federated SP)AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_SUBSCRIPTION_IDUse azure/login OIDC or equivalent Entra federated auth
App Service (psi-internal runner)No deploy secret requiredUses runner managed identity (az login --identity)
Static Web AppAZURE_STATIC_WEB_APPS_API_TOKENRequired for SWA deploy action
Wiki automationWIKI_ACCESS_TOKENGHE API access token for wiki sync tasks

Deployment Credential Operations

# Verify basic publishing credentials are disabled (production baseline)
az rest --method get \
  --uri "https://management.azure.com/subscriptions/<SUB_ID>/resourceGroups/PS-WEBAPPS/providers/Microsoft.Web/sites/<APP_NAME>/basicPublishingCredentialsPolicies/scm?api-version=2022-03-01"
az rest --method get \
  --uri "https://management.azure.com/subscriptions/<SUB_ID>/resourceGroups/PS-WEBAPPS/providers/Microsoft.Web/sites/<APP_NAME>/basicPublishingCredentialsPolicies/ftp?api-version=2022-03-01"
 
# Static Web App deployment token (still required)
az staticwebapp secrets list \
  --name psi-wiki --resource-group PS-WEBAPPS \
  --query "properties.apiKey" -o tsv
 
# Set/update a GitHub secret on GHE.com
GH_HOST=progressivesurface.ghe.com gh secret set SECRET_NAME \
  -R ProgressiveSurface/repo-name --body "value"

Resource Groups

Resource GroupPurposeKey Resources
PS-WEBAPPSAll production web applications16 App Services, 3 Function Apps, 1 Static Web App, 2 SQL Servers, 1 KV, 1 ACR, App Service Plans
PS-RG-01Core infrastructureVNet (PS-VNMAIN), DNS zone, VMs, Key Vaults, ps-shipphotos, Logic Apps, Service Bus, Automation
ProcServices-Prod-DataDatabase resourcesprocserv-proddata SQL server (10 databases)
PsRedbookPhotosRedbook photo storagepsredbookphotos App Service, SyncBlogtoSdrive Logic App
PSLogicAppsIntegration workflowsPaylocityInbound, redbook-feedback-notifier, entra-bc-employee-sync Logic Apps
PS-SPEECHAI / Speech servicesPS-SPEECH1, PS-SPEECH2 Cognitive Services (SpeechServices F0)
rg-GPT5-9353AI Foundry (GPT-5)gpt5-9353-resource, adeve-midqp8v8-eastus2 AIServices
SERVER-NCUS-CSPCSP-managed server infraakv-19 Key Vault, nmm-app-runbooks Automation Account
AVD-NCUS-CSPAzure Virtual Desktop (CSP)PS-AVD-DEV-0, PS-AVD-POOL-0 session hosts (Worksighted managed)
AzureIOT_TestIoT dev/testPSTestHub IoT Hub

Virtual Machines & Runners

Azure VMs

VM NameOSResource GroupSizeSubnet / IPPurpose
ps-cicd-runnerUbuntu 24.04PS-RG-01Standard_B2as_v2PS-SERVERS / 10.160.0.9GitHub Actions runner (primary)
ps-cicd-runner-2Ubuntu 24.04PS-RG-01Standard_B2sPS-SERVERS / 10.160.0.18GitHub Actions runner (secondary)
PS-AZ-DC01Windows ServerPS-RG-01—PS-SERVERS / 10.160.0.5Domain controller, DNS server
PS-AZ-SFTP1Windows ServerPS-RG-01—PS-SERVERS / —SFTP file transfer server
PS-AZ-APPS-0Windows ServerPS-RG-01—PS-SERVERS / —Application server (purpose TBD)
PS-AZ-LS3Windows ServerPS-RG-01—PS-SERVERS / —Line Scanning / LS3 server
PS-AZ-OPTIXWindows ServerPS-RG-01—PS-SERVERS / —Cognex OPTIX vision server
PS-AZ-SRVC-0Windows ServerPS-RG-01—PS-SERVERS / —Service VM (purpose TBD)
ps-argo-etlLinuxPS-RG-01—PS-SERVERS / —ETL backend for ps-argo-analytics

Note: ps-cicd-runner-2 has an NSG (ps-cicd-runner-2NSG) with only inbound SSH allow; outbound is default-allow. ps-cicd-runner has no NSG. Both runners have identical software: Node.js 20, Python 3.12, .NET 8 SDK, GitHub Actions runner v2.334.0.

GitHub Actions Runners

Registered to progressivesurface.ghe.com/ProgressiveSurface.

Runner NameOSLocationLabelsServes
ps-cicd-runnerLinuxAzure VM (PS-RG-01)self-hosted, Linux, X64, psi-internalredbook-web, psi-explorer-web, project-explorer, erp-migration-tool, and other Linux deploys
ps-cicd-runner-2LinuxAzure VM (PS-RG-01)self-hosted, Linux, X64, psi-internalSame as ps-cicd-runner (parallel capacity)
PS-GR-RUNNERWindowsOn-premisesself-hosted, Windows, X64, dotnet-frameworkPSI.All CI (CredentialsManager, parity harness)
PS-PROXYWindowsOn-premises serverself-hosted, Windows, X64, ps-proxy, dotnet-8, node, unidata-accessPSI.UniData.API deploy
PS-PLCRunnerWindowsOn-premisesself-hosted, Windows, X64, ps-plcrunnerPLC-related workflows

ps-cicd-runner / ps-cicd-runner-2 deploy to App Services with private endpoints. Runner agent at /home/runner/actions-runner/, runs as runner user, managed by systemd (actions.runner.ProgressiveSurface.<name>.service).

To register a new Linux runner:

# Generate token (valid 1 hour)
GH_HOST=progressivesurface.ghe.com gh api --method POST orgs/ProgressiveSurface/actions/runners/registration-token
 
# On the VM (as root):
mkdir -p /home/runner/actions-runner && cd /home/runner/actions-runner
curl -o runner.tar.gz -L https://github.com/actions/runner/releases/download/v2.334.0/actions-runner-linux-x64-2.334.0.tar.gz
tar xzf runner.tar.gz && rm runner.tar.gz
chown -R runner:runner /home/runner/actions-runner
./bin/installdependencies.sh
sudo -u runner ./config.sh --url https://progressivesurface.ghe.com/ProgressiveSurface --token <TOKEN> --name <NAME> --labels psi-internal --unattended --replace
./svc.sh install runner && systemctl start actions.runner.ProgressiveSurface.<NAME>.service

PS-PROXY hosts the UniData API directly. Runner at C:\actions-runner.

Database Resources

ResourceTypeFQDNRegionResource Group
procserv-proddataAzure SQL Serverprocserv-proddata.database.windows.netNorth Central USProcServices-Prod-Data
psi-zebra-tracking-sqlAzure SQL Serverpsi-zebra-tracking-sql.database.windows.netNorth Central USPS-WEBAPPS

Used by: PRGJSMES, project-explorer, erp-migration-tool (→ procserv-proddata); ZebraTracking (→ psi-zebra-tracking-sql).

Region constraint: North Central US has no availability zones. Zone-redundant databases (ZR-DB) and GZRS/ZRS backup redundancy are therefore not available on this server. Use GRS (geo-redundant) for backup storage and rely on PITR + LTR + (optional) failover groups to South Central US for DR. Any app that requires ZR-DB must provision a new server in an AZ-capable region (e.g. South Central US, East US 2).

Backup Policies

Per-database backup policies (current state, as of 2026-06-01):

DatabasePITR retentionLTR (weekly/monthly/yearly)Backup storageUsed SizeNotes
PRGJSMES35 days4W / 12M / 5Y (week 1)GRS (Geo)~407 MBProduction MES — compliance + DR baseline; ⚠️ autopause disabled (~$760/mo)
PSI_Analytics7 daysnoneGRS~8.4 GB⚠️ Needs LTR; large dataset
CapExNext7 daysnoneGRS~28 MB⚠️ Needs LTR
winget14 daysnoneGRS~26 MB⚠️ Needs LTR
CalibrationPortal7 daysnoneGRS~31 MB⚠️ Needs LTR
DataSync7 daysnoneLRS~12.2 GB⚠️ Needs LTR + Geo storage; 10 DTU severely underpowered for 12 GB
Procisely7 daysnoneLRS~26 MB⚠️ Needs LTR + Geo storage
PS-Line67 daysnoneLRSPausedPaused — ⚠️ Needs LTR + Geo storage; confirm decommission
PS-AZ-PSDB017 daysnoneLRSPausedPaused — ⚠️ Needs LTR + Geo storage; confirm decommission
alerts7 daysnoneLRS~TBDGP_S Gen5 1 vCore, Online — ⚠️ Needs LTR + Geo storage; new DB (first seen 2026-06-24)

psi-zebra-tracking-sql databases:

DatabasePITR retentionLTRBackup storageNotes
psi-zebra-tracking-db7 daysnone(default)~30 MB

Maintenance commands:

# View current PITR policy
az sql db str-policy show -g ProcServices-Prod-Data -s procserv-proddata -n PRGJSMES
 
# View current LTR policy
az sql db ltr-policy show -g ProcServices-Prod-Data -s procserv-proddata -n PRGJSMES
 
# Update PITR retention (max 35 days on GP tier)
az sql db str-policy set -g ProcServices-Prod-Data -s procserv-proddata -n <db> \
  --retention-days 35 --diffbackup-hours 12
 
# Set LTR policy (ISO 8601 durations)
az sql db ltr-policy set -g ProcServices-Prod-Data -s procserv-proddata -n <db> \
  --weekly-retention P4W --monthly-retention P12M --yearly-retention P5Y --week-of-year 1
 
# Change backup storage redundancy (Local | Zone | Geo | GeoZone — Zone/GeoZone unsupported in NCUS)
az sql db update -g ProcServices-Prod-Data -s procserv-proddata -n <db> \
  --backup-storage-redundancy Geo

Restore from backup:

# Point-in-time restore (within PITR window — up to 35 days)
az sql db restore -g ProcServices-Prod-Data -s procserv-proddata -n PRGJSMES-restored \
  --dest-name PRGJSMES-restored --source-database PRGJSMES --time "2026-04-20T12:00:00Z"
 
# Restore from a long-term backup (list first, then restore by resource ID)
az sql db ltr-backup list --location northcentralus \
  --resource-group ProcServices-Prod-Data --server procserv-proddata --database PRGJSMES

Connecting to Azure SQL

The SQL server uses a private endpoint (PS-ProdData-SQL-Private at 10.160.140.4). On the PSI network, DNS resolves to the private IP via the privatelink.database.windows.net zone on PS-AZ-DC01.

Required tool: sqlcmd (go-sqlcmd) — the modern cross-platform SQL CLI with Entra MFA support.

# Install
winget install sqlcmd
 
# Connect (uses your az login session for auth)
sqlcmd -S procserv-proddata.database.windows.net -d PRGJSMES --authentication-method=ActiveDirectoryDefault

Note: The legacy SQLCMD.EXE (in C:\Program Files\Microsoft SQL Server\Client SDK\) does NOT support Entra MFA. It fails with AADSTS50076. Always use the new go-based sqlcmd installed via winget (installs to C:\Program Files\sqlcmd\).

Alternatives: SSMS or Azure Data Studio also work — use “Microsoft Entra MFA” authentication.

SQL Server Entra Admin

PropertyValue
AdminADevereaux@progressivesurface.com
Public AccessEnabled (firewall rules for PSI office IPs)
Private EndpointPS-ProdData-SQL-Private (10.160.140.4)
TLS1.2 minimum

Database Users

DatabaseUserRolePurpose
PRGJSMESprgjsmes-proddb_ddladmin, db_datareader, db_datawriterApp Service managed identity
PRGJSMESdcooper@progressivesurface.comdb_ownerDBA / schema management

Managing Database Users

# Create user from Entra ID
sqlcmd -S procserv-proddata.database.windows.net -d PRGJSMES \
  --authentication-method=ActiveDirectoryDefault \
  -Q "CREATE USER [user@progressivesurface.com] FROM EXTERNAL PROVIDER"
 
# Grant db_owner
sqlcmd -S procserv-proddata.database.windows.net -d PRGJSMES \
  --authentication-method=ActiveDirectoryDefault \
  -Q "ALTER ROLE db_owner ADD MEMBER [user@progressivesurface.com]"
 
# Verify
sqlcmd -S procserv-proddata.database.windows.net -d PRGJSMES \
  --authentication-method=ActiveDirectoryDefault \
  -Q "SELECT dp.name, r.name AS role_name FROM sys.database_principals dp JOIN sys.database_role_members rm ON dp.principal_id = rm.member_principal_id JOIN sys.database_principals r ON rm.role_principal_id = r.principal_id WHERE dp.type IN ('E','X')"

Key Vault

PropertyValue
Nameps-certificates-kv
Resource GroupPS-RG-01
Vault URIhttps://ps-certificates-kv.vault.azure.net/

Contents

Secret/CertificatePurpose
wildcard-progressivesurfaceWildcard SSL cert (*.progressivesurface.com) — thumbprint: 8ECD7C39FA4BD44E10D3D89A80EF33F3922A291A, expires 2027-02-03
App-specific secretsReferenced via @Microsoft.KeyVault(...) in App Service settings

Static Web App

PropertyValue
Namepsi-wiki
Default Hostnamehappy-flower-0b5174910.6.azurestaticapps.net
Custom Domainwiki.progressivesurface.com
SKUFree ⚠️ (no auth restriction, no private endpoint)
RepositoryPSI-Wiki-Site (branch: v4) — ⚠️ repoUrl not connected
Resource GroupPS-WEBAPPS

⚠️ The Static Web App is on Free tier. Consider upgrading to Standard ($9/mo) to enable AAD authentication restrictions (internal-only access). Deployment uses an API token — rotate if the token is committed to any repository.

Networking Quick Reference

ResourceValue
VNetPS-VNMAIN
DNS Zoneprogressivesurface.com (in PS-RG-01)
Private DNS Zoneprivatelink.azurewebsites.net (in PS-RG-01)
Primary DNS Server10.160.0.5 (PS-AZ-DC01)

Subnets

SubnetCIDRPurpose
PS-SERVERS10.160.0.0/23VMs, private endpoints (legacy)
PS-WebApps10.160.150.0/24App Service VNet integration (delegated)
PS-ProdData10.160.140.0/24Private endpoints (preferred for new)
PS-VMXSBNT10.160.50.0/24VMs

Private Endpoints

ServicePrivate EndpointIP AddressSubnet
psi-portalpsi-portal-pe10.160.0.6PS-SERVERS
shippingappfunctions—10.160.0.16PS-SERVERS
psi-explorer-webbom-explorer-web-pe10.160.0.17PS-SERVERS
psi-tap-bridgepsi-tap-bridge-pe10.160.140.6PS-ProdData
erp-migration-apiERPMigrationAPIEndpoint10.160.140.9PS-ProdData
ps-project-explorerps-project-explorer-pe10.160.140.10PS-ProdData
prgjsmes-prodprgjsmes-prod-pe10.160.140.11PS-ProdData
prgjsmes-prod (staging slot)prgjsmes-prod-staging-pe10.160.140.18PS-ProdData
prgjsmes-prod (⚠️ duplicate)prgjsmes-prod-pe (PS-WEBAPPS)10.160.140.13PS-ProdData
redbook-webredbook-web-pe10.160.140.12PS-ProdData
ps-redbook-dashboardps-redbook-dashboard-pe10.160.140.14PS-ProdData
ps-progressive-viewps-progressive-view-pe10.160.140.15PS-ProdData
ps-argo-analyticsps-argo-analytics-pe10.160.140.16PS-ProdData
ps-winget-sourceps-winget-source-pe10.160.140.17PS-ProdData
ps-buildvsbuy 🚧ps-buildvsbuy-pe10.160.140.5PS-ProdData
psi-datasyncpsi-datasync-pe10.160.0.19PS-SERVERS
ps-dispatchps-dispatch-pe10.160.140.22PS-ProdData
psargostoragePSARGOSHAREPRIVATE10.160.0.11PS-SERVERS
procserv-proddataPS-ProdData-SQL-Private10.160.140.4PS-ProdData
psi-zebra-tracking-sqlpsi-zebra-tracking-sql-pe10.160.140.21PS-ProdData
psizebratracking-iotAzureIOT_PE(dev/test)—
ps-certificates-kvps-certificates-kv-pe10.160.140.23PS-ProdData
psi-servicepsi-service-pe10.160.140.24PS-ProdData

Next free PS-ProdData PE IP: 10.160.140.25 (.4/.5/.6/.9–.18/.21–.24 in use). ⚠ .23 is the ps-certificates-kv PE (privatelink.vaultcore.azure.net zone — invisible from the azurewebsites zone), so check live NIC allocations across the whole /24, not just the webapp DNS zone, before pinning a new IP (psi-service hit this 2026-06-29). The prgjsmes-prod-pe at 10.160.140.13 (PS-WEBAPPS) is a duplicate of the production web PE at 10.160.140.11 (PS-RG-01) — flagged for cleanup in psi-azure-admin#1.

⚠️ No private endpoint: psi-zebra-tracking (app), psi-notify-listener, csm-board, ps-shipphotos, psredbookphotos, procisely-redirect. These are either exempt (see webapp-compliance-standard) or pending remediation. psi-zebra-tracking and psi-datasync apps additionally still have public access enabled despite policy — see psi-azure-admin#1.

Logic Apps / Integrations

NameResource GroupPurposeAuth Method
PaylocityInboundPSLogicAppsHR/payroll inbound dataAPI connection (unknown)
redbook-feedback-notifierPSLogicAppsRedbook notification emailsAPI connection (unknown)
entra-bc-employee-syncPSLogicAppsEntra ↔ Business Central employee syncAPI connection (unknown)
SyncBlogtoSdrivePsRedbookPhotosSync blog content to ShareDriveAPI connection (unknown)
egnyte-stp-syncPS-RG-01Egnyte file storage syncAPI connection (unknown)

⚠️ Logic App connector credentials are stored in Microsoft.Web/connections resources, NOT in Key Vault. Each workflow’s authentication should be reviewed and migrated to managed identity where supported. As of May 2026 this has not been done.

AI / Cognitive Services

NameResource GroupKindSKULocal AuthNotes
PS-SPEECH1PS-SPEECHSpeechServicesF0⚠️ EnabledDev/test free tier
PS-SPEECH2PS-SPEECHSpeechServicesF0⚠️ EnabledDev/test free tier
gpt5-9353-resourcerg-GPT5-9353AIServicesS0⚠️ EnabledGPT-5 evaluation
adeve-midqp8v8-eastus2rg-gpt5-9353AIServicesS0⚠️ EnabledAI Foundry project
psi-foundry-dcooperPS-WEBAPPSAIServicesS0⚠️ EnabledPersonal AI Foundry (dcooper) — ⚠️ in PS-WEBAPPS RG

Recommendation: Set disableLocalAuth=true on any production Cognitive Services account to enforce managed identity authentication and disable API key access.

RBAC — Subscription-Level Assignments

PrincipalTypeRoleNotes
ADevereaux@progressivesurface.comUserOwnerIT lead
progadmin@progressivesurface.comUserOwnerShared admin
wsadmin@progressivesurfaceinc.onmicrosoft.comUserOwnerBreak-glass account (.onmicrosoft.com)
worksighted@progressivesurface.comUserOwnerWorksighted MSP — approved for AVD/CSP mgmt
account-web-admin-portal-4v72iquhmxtiu (NMM #1)Service PrincipalOwnerNerdio Manager — manages PS-RG-01 infra
account-web-admin-portal-y7jefihe7cin6 (NMM #2)Service PrincipalOwnerNerdio Manager — manages SERVER-NCUS-CSP/AVD
poperative@progressivesurface.comUserContributorOperations account

Best practice: ≤3 subscription Owners. PSI currently has 5 Users/SPs with Owner. Recommendation: move wsadmin and worksighted to PIM Just-in-Time access; convert NMM SPs to a custom role scoped to AVD resource groups.

Source Control

PropertyValue
PlatformGitHub Enterprise Cloud (EMU)
URLhttps://progressivesurface.ghe.com/ProgressiveSurface
Repositories13
Identity ProviderMicrosoft Entra ID (SCIM)

Last updated: 2026-06-25 (doc-currency audit — resolved TBD private-endpoint IPs, cataloged ps-buildvsbuy, flagged duplicate prgjsmes-prod-pe)

Graph View

Backlinks