Prerequisites
Everything the deploy and first-week setup will ask of you, in one place. Line these up first and the quick start really is five minutes.
Azure subscription + roles
| Requirement | Why |
|---|---|
An Azure subscription in a region with Azure OpenAI (westus3, eastus2, swedencentral are reliable choices) | Every resource deploys into it — you own the infrastructure. |
| Owner on that subscription — or Contributor + User Access Administrator | The template creates RBAC role assignments for the Function App’s managed identity. Contributor alone fails at the first role assignment (the exact error + fix). |
| Permission to make Azure Marketplace purchases | Some organizations restrict Marketplace buying via EA/MCA purchase policies. If Get It Now is greyed out or checkout is blocked, ask your billing admin to allow Marketplace purchases (or this specific offer) for your subscription. |
One consequence worth knowing up front: after deploy, the stack lives in a Managed Resource Group your account can read but not modify. Deploy-time choices (allowed origins, system prompt, resource tiers) are therefore worth getting right the first time — post-install changes go through the dashboard, the Marketplace, or support.
Azure OpenAI quota
The deploy creates a gpt-5-mini (GlobalStandard SKU) model deployment in your subscription. If your subscription has no gpt-5-mini quota in the chosen region, the deploy fails partway.
Check before you buy: Azure AI Foundry → Quotas — look for gpt-5-mini GlobalStandard capacity in your target region. Request quota there if needed (approval for small asks is typically minutes). Details in OpenAI quota troubleshooting.
Microsoft Teams
| Requirement | Why |
|---|---|
| Teams Administrator (or Global Administrator) role | One-time upload of the per-deployment Teams app .zip in Teams Admin Center, setting it to Allowed, and pinning it via an App setup policy. |
| Custom app upload permitted by your org’s Teams app policies | The app arrives as a custom (sideloaded) app, not from the Teams store. |
Your agents need nothing special — a normal Teams license and the pinned tab.
Microsoft Entra ID
Whoever runs the one-time AAD app setup needs permission to create app registrations in your tenant — the tenant default allows all users; if your org has disabled that, use an account with the Application Developer role (or an admin).
Your website
Somewhere to paste one <script> tag — and the list of https:// origins it will load from, which you enter in the wizard as allowed origins (changing that list later currently requires a support request, so bring the real domains).