---
title: "Installing Amplia on Azure App Services"
description: "How to install an on-premises instance of Amplia on an Azure App Service: container registry, database, storage account, domains and configuration."
canonical: "https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises/azure/install"
locale: "en"
product: "Amplia"
last_updated: "2026-10-12"
---

# Installing Amplia on Azure App Services

To install an [on-premises](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises) instance of [Amplia](https://docs.lacunasoftware.com/en-us/articles/amplia) on an [Azure App Service](https://docs.microsoft.com/azure/app-service/overview),
follow the steps below. For other platforms, [click here](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises#supported-platforms).

> **Tip**
>
> Before you start, read the section [Planning before installation](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises#planning).

> **Tip**
>
> To be able to use the free SSL certificates provided by *App Service Managed Certificates*, we suggest not choosing "naked domains",
> that is, domains without a subdomain portion, for example ~~patorum.com~~. Prefer, for instance, `ca.patorum.com`.

## Preparation

The instructions below assume that you already have the [Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) installed locally and that you
already have the following resources created on your Azure account:

* A *SQL Server* (creating the *SQL database* is covered by this article)
* An *App Service Plan* with the **Linux** operating system (creating the App Service is covered by this article)
* DNS zones for the [dashboard domain](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises#dashboard-domain)
  and the [access domains](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises#access-domains)

During the installation, some resources will be created:

* A *Container Registry*
* A database (*SQL database*)
* A *storage account*
* An App Service
* An Azure Key Vault (optional)

We suggest creating a **resource group** to group the resources you create. However, this is merely an organizational measure. What
really matters is that **all resources are created in the same region**. This is essential for the system to work properly.

> **Note**
>
> The steps below describe the most basic creation of each resource. Depending on your infrastructure you may want to take
> additional security or resilience measures, such as restricting access to a private network.

## Creating a *Container registry*

Follow the steps below to create a *container registry* to store a local copy of the system's Docker images:

1. Under **Container registries**, click **+ Create**
1. On the first tab (*Basics*)
   * Fill in the fields according to your infrastructure (following the region chosen for the system)
   * Take note of the chosen *registry name*
   * Under *SKU*, choose **Basic**
1. Click **Review + create**, then **Create**

Once the *container registry* has been created, replicate the system's Docker image to it (replace `MY_ACR_NAME` with the name chosen
in the previous step):

```sh
az login
```

> **Note**
>
> If you have access to more than one Azure account, you may need to pass the `--tenant YOUR_TENANT` argument

```sh
az acr login --name MY_ACR_NAME
az acr import --name MY_ACR_NAME --source docker.io/lacunasoftware/amplia:5.0.0 --image amplia:5.0.0
```

## Creating the database

Follow the steps below to create a database for the system (you must have a *SQL Server* previously created):

1. Under **SQL databases**, click **+ Create**
1. On the first tab (*Basics*), fill in the fields according to your infrastructure (following the region chosen for the system)
1. Click the **Additional settings** tab
1. Under **Collation**, enter `Latin1_General_100_CI_AI`
1. Click **Review + create**
1. Click **Create**

> **Warning**
>
> The database *collation* **MUST BE** `Latin1_General_100_CI_AI`. Creating the database with a different *collation* will likely cause the installation to fail!

Once the database has been created, click **Go to resource**. Then obtain the *connection string*:

1. Click **Connection strings**
1. Take note of the connection string shown under the **ADO.NET (SQL authentication)** section

> **Note**
>
> In the copied connection string, replace the `{your_password}` placeholder with the database password

## Creating a *storage account*

We need a *storage account* to store files (the system stores files outside the database to keep it organized) and also the
system logs. Follow the steps below to create a *storage account* (if you want to use an existing account, skip this part):

1. Under **Storage accounts**, click **+ Create**
1. On the first tab (*Basics*), fill in the fields according to your infrastructure (following the region chosen for the system)
   * Under *Performance*, choose **Standard**
   * Under *Redundancy*, choose the option you prefer (we suggest **Zone-redundant storage (ZRS)** -- [click here](https://azure.microsoft.com/documentation/articles/storage-redundancy/)
     for details on the different replication options)
1. Click **Review**
1. Click **Create**

Once the *storage account* has been created, click **Go to resource**. Then obtain a *connection string*:

1. In the *storage account* settings, click **Access keys**
1. Under the **key1** section, take note of the value of the **Connection string** field

## Creating the App Service

Follow the steps below to create an *App Service* (you must have an *App Service Plan* previously created with the **Linux** operating system):

1. Under **App Services**, click **+ Create** then **+ Web App**
1. On the first tab (*Basics*), fill in the fields according to your infrastructure (following the region chosen for the system)
   * Under *Publish*, choose **Docker Container**
   * Under *Operating System*, choose **Linux**
   * Under *Region*, choose the region where your *app service plan* is located
   * Under *Linux Plan*, choose your *app service plan*
   * Click **Next : Docker >**
1. On the next tab (*Docker*), fill in:
   * Under *Options*, leave the **Single Container** option
   * Under *Image Source*, select **Azure Container Registry**
   * Under *Registry*, select the *container registry* created earlier
   * Under *Image* and *Tag*, select the system's image/tag according to the `az acr import` command run earlier
   * Leave the *Startup Command* option **blank**
   * Click **Review + create**
1. Click **Create**

Once the App Service has been created, click **Go to resource**. Then take note of its domain, for example `my-app-service.azurewebsites.net`.

Go to the App Service **Configuration** and add the following settings:

* `ASPNETCORE_ENVIRONMENT`: `Azure`
* `Bindings__HttpsMode`: `Strict`
* `STANDBY`: `True`

Save the settings.

Still in the App Service configuration, go to the **General settings** tab and, under the **HTTPS Only** option, select **Off** (the application itself will take care of requiring HTTPS access in the most appropriate way).

Then go to **Custom domains** and copy the **Custom Domain Verification ID** (this value will be needed later).

## Domain configuration

Create the DNS records needed for the [dashboard domain](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises#dashboard-domain) and
the [access domains](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises#access-domains):

> **Note**
>
> Depending on your choices, the procedure below may have to be done only once (if you chose a single access domain and intend
> to use it as the dashboard domain as well) or up to three times (if you chose two access domains and intend to use a third domain
> to access the dashboard).

> **Note**
>
> In the instructions below, we will use the creation of the record for the domain `app.patorum.com` as an example

1. Under **DNS zones**, click the zone the domain belongs to (e.g.: `patorum.com`)
1. Click **+ Record set**
1. Under *Name*, type the leftmost portion of the domain (e.g.: `app`)
1. Under *Type*, select **CNAME**
1. Under *Alias record set*, select **No**
1. Under *Alias*, fill in the App Service domain (e.g.: `my-app-service.azurewebsites.net`)
1. Click **OK**
1. Click **+ Record set** again
1. Under *Name*, type `asuid.` followed by the leftmost portion of the domain (e.g.: `asuid.app`)
1. Under *Type*, select **TXT**
1. Under *Value*, paste the **Custom Domain Verification ID** previously copied from the App Service
1. Click **OK**

> **Note**
>
> If you do not use Azure as the DNS server for your zones, perform the equivalent procedure on your DNS server

After creating the records for all domains (1 to 3 domains, depending on your choices),
add the domains to the *App Service* (repeat the procedure below for each domain):

1. Back in the App Service settings, click **Custom domains**
1. Click **+ Add custom domain**
1. Select **All other domain services**
1. Leave the **App Service Managed Certificate** and **SNI SSL** options selected
1. Under *Domain*, fill in the domain (e.g.: `app.patorum.com`)
1. Click **Validate**
1. After validation, click **Add**

## Amplia configuration

On the App Service side menu, under the *Development Tools* section, click **SSH**, then **Go →**. You will be taken to a terminal. Navigate
to the `/app` folder:

```bash
cd /app
```

> **Tip**
>
> Even though the terminal appears to start in the `/app` folder, the command above **is necessary** due to an Azure bug

Run the command below to generate the cryptographic key used to encrypt sensitive values stored in the database:

```cmd
dotnet Lacuna.Amplia.Site.dll -- gen-enc-key
```

Take note of the generated value.

Choose a strong password to protect *root* access to the dashboard, and compute the hash of that password with the command below:

```cmd
dotnet Lacuna.Amplia.Site.dll -- hash-root-pass
```

Again, take note of the generated value.

Close the terminal, returning to the Azure portal. On the App Service, go to **Configuration** and add the following settings:

* `General__AppDiscriminator`: `Amplia`
* `General__EncryptionKey`: the cryptographic key generated above
* `General__RootPasswordHash`: the *root* password hash computed above
* `General__SiteUrl`: the public URL of the site, on the [dashboard domain](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises#dashboard-domain) (e.g.: `https://ca.patorum.com/`)
* `General__SiteName`: the name of your Amplia instance, e.g.: *Patorum CA*
* `Oidc__Enabled`: `False` (disables the [OpenID Connect integration](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises/configure-oidc), for now)

Also add the settings described in the sections below.

### Access domains

Configure the [access domains](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises#access-domains):

* `Amplia__AccessDomains`: the access domains, separated by commas, e.g.: `ca.patorum.com,ca.patorum.org`

### PKI Suite

PKI Suite settings:

* `PkiSuite__SdkLicense`: your license for the PKI SDK, in Base64 format (**required**)
* `PkiSuite__WebLicense`: your license for the Web PKI component in binary (Base64) format. Only required if users will be issued certificates on their own computers (web issuance procedure)

### Blob Storage

*storage account* configuration:

* `BlobStorage__ConnectionString`: the *connection string* of the *storage account* created earlier
* `BlobStorage__ContainerName` (optional): the name of the *container* used to store files. If omitted, a container named *amplia* is used.

### Logging

Log configuration:

* `Serilog__WriteTo__0__Args__connectionString`: the *connection string* of the *storage account* created earlier
* `Serilog__WriteTo__0__Args__storageTableName` (optional): the name of the table used to store the logs. If omitted, a table named *AmpliaLog* is used.

### Connection string

In the *Connection strings* section (at the bottom of the settings page), click **+ New connection string** and fill in:

* **Name**: `DefaultConnection`
* **Value**: the connection string value obtained while creating the database
* **Type**: choose **SQLAzure**

Save the settings made so far by clicking **Save**.

### Key storage

As explained in the [Key storage](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises#key-storage) section of the installation planning, you must configure at least one key store to
store keys. On Azure, we recommend storing keys on **Azure Key Vault**. To do so, follow the [configuration instructions](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises/key-stores/azure) using
`Azure` as the key store name. Then add the setting:

* `Amplia__DefaultKeyStore`: `Azure`

Another option is to use the [database key store](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises/key-stores/database). In that case, add the following settings:

* `Amplia__DatabaseKeyStoreEnabled`: `True`
* `Amplia__DefaultKeyStore`: `Database`

### Optional settings

We recommend not changing these settings for now. Once your Amplia instance is up and running, you
can visit each of the links below to enable optional features:

* [HTTPS redirection](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises/configure-https-redirect)
* [Sending emails](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises/configure-email)
* [OpenID Connect integration](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises/configure-oidc) (required for user management)
* [Sending SMS](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises/configure-sms) (required by the certificate issuing page for end users)

> **Note**
>
> In the links above, whenever something like "in the **Sec** section, set the **Conf** setting to ..." is mentioned, on Azure App Services you must
> compose the setting name from the section and setting names separated by `__` (**two** underscores), that is, in the example above: `Sec__Conf`

## Starting the App Service

Finally, remove the `STANDBY` setting from the App Service and save the settings. Then access the dashboard URL (the first access may take a few moments).

Authenticate with the *root* password chosen during configuration. You will then have access to the dashboard, and the installation will be complete.

## See also

* [Updating Amplia on Azure App Services](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises/azure/update)
* [Troubleshooting](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises/azure/troubleshoot)