Managed Resource Group
When you deploy a Managed Application, Azure creates two resource groups:
- Applications RG — usually named after your subscription’s default, holds the outer Managed Application resource. You see this in the Azure portal Resource Groups list.
- Managed RG — named
mrg-pointofcontactai-{guid}, holds all the actual resources (Function App, Cosmos, Key Vault, etc.). You cannot directly edit resources in this RG.
The Managed RG is “managed” by us (the publisher). We’re granted Contributor on it so we can apply in-place plan upgrades, ship customer-runtime updates, and make support-requested configuration changes without your intervention.
You own the infrastructure. Both resource groups live in your Azure subscription. Your conversation data never leaves your tenant, PointOfContactAI holds zero standing access to it, and the only thing that ever leaves your stack is a content-free seat count for Marketplace billing. Because every resource is in your own subscription, Microsoft bills you directly for that infrastructure — separately from, and on top of, the per-seat plan license.
What this means for you
The Managed RG carries a Managed Application deny assignment (read-only lock) for everyone in your tenant. Concretely:
- ✅ You can read everything in the Managed RG — browse resources in the portal, view metrics, query your Application Insights and Activity Log.
- ✅ You can delete the Managed Application from the Applications RG — that triggers a full cleanup of the Managed RG. This destroys all data immediately; see Cancel & uninstall.
- ❌ You cannot modify resources in the Managed RG via the portal, CLI, or ARM: no app-setting changes, no restarts, no role assignments, no Key Vault data-plane access (nobody in your tenant holds a KV data-plane role — only the Function App’s managed identity does).
azcommands against these resources fail with a deny-assignment error.
Where each change actually happens
| What you want to change | Supported path |
|---|---|
| Admin key | Rotate admin key button in the dashboard — runs inside your stack, no RG write needed. Details → |
| Plan / seat quota | Marketplace Change plan blade — we PATCH your stack within seconds. Details → |
| Allowed widget origins | Support request (we apply the change with our Contributor access). |
| System prompt / token pricing | Support request. |
| AAD app values for Teams SSO | You create the AAD app in your Entra tenant (not locked); we set the three non-secret values on your Function App. Details → |
| Customer-runtime version | Shipped by us automatically. How updates reach your stack → |
| Resource tiers (SignalR SKU, Cosmos mode, …) | Fixed at deploy time; changing them requires a fresh deploy. Details → |
What we use the Contributor access for
- Plan upgrades — when you change plan in the Marketplace, we PATCH the customer FA’s app settings (
SEAT_QUANTITY,PLAN_DISPLAY_NAME, etc.) within seconds. Zero downtime. - Customer-runtime updates — when we ship a new version, we publish to your Function App via the deployment storage container. How updates reach your stack →
- Support-requested configuration changes — the settings you can’t change yourself under the deny assignment (allowed origins, system prompt, AAD app values). Every such change appears in your Activity Log.
We do not use this access to:
- Read your Cosmos data — and we can’t: the account has key-based auth disabled, and Contributor carries no Cosmos data-plane role. Only your Function App’s managed identity can read it.
- Read your Key Vault secrets — the vault uses RBAC mode and Contributor carries no Key Vault data-plane role. Only your Function App’s managed identity holds one.
- Run code as your tenant (we use our own Contributor scope only on the Managed RG).
How to verify
Anything we do gets logged in your Activity Log under the Managed RG with the principal PointOfContactAI-Orchestrator (our app id d3393ba1-85a0-496c-8c07-49d020e1fabd). If you see anything you don’t expect, open an issue.