Before you install

What to send Isomer, what to prepare in your Azure subscription, and what Isomer sends back before you install.

There are three steps. Start the first two together: Isomer sets up its side while you prepare your subscription.

1. Send Isomer your details

Send these to your Isomer contact:

• Subscription: the ID of the Azure subscription you will install into, and its Entra tenant ID.
• Access mode: private, reached only from your network, or public, on Isomer hostnames. See Private or public access.
• For private access, your hostnames: three names under a domain you control.
• For private access, your network range: the address space for the install's virtual network.

Choosing hostnames

One hostname is for the API your users' browsers call; the other two are for the workflow console and the monitoring dashboards Isomer's operators use. For example: api.isomer.contoso.com, temporal.isomer.contoso.com and grafana.isomer.contoso.com. Isomer configures sign-in for the API hostname, so it cannot change after the install.

Choosing a network range

A range from /16 to /22 that does not overlap any network you will peer with the install.

2. Prepare your subscription

Do these in your own Azure tenant while Isomer sets up its side.

Use a dedicated subscription

Use a subscription dedicated to Isomer: quotas, feature registrations and Marketplace access are all set per subscription. The person who runs the install needs permission to create resources in it, such as the Contributor or Owner role.

Allow the regions

The install runs in East US 2, apart from its Redis cache, which runs in East US. If your organization restricts which regions can be used, allow both.

Register host encryption

The platform encrypts its node disks at the host, which Azure allows only once the EncryptionAtHost feature is registered on the subscription. Registration takes a few minutes:

az account set --subscription {subscription-id}
az feature register --namespace Microsoft.Compute --name EncryptionAtHost
az feature show --namespace Microsoft.Compute --name EncryptionAtHost --query properties.state -o tsv   # repeat until Registered
az provider register --namespace Microsoft.Compute --wait

Request quota

New subscriptions start below what the install needs, so every install needs an increase. Request it in East US 2 through Quotas in the Azure portal (provider Compute), or with a support request of type Service and subscription limits (quotas):

The requested amounts leave room for the platform to grow and for upgrades, which briefly add nodes. To check where your quota stands (the quota names are case-sensitive):

az vm list-usage --location eastus2 --subscription {subscription-id} \
  --query "[?contains(['Standard Ddsv6 Family vCPUs', 'Standard Bsv2 Family vCPUs', 'Total Regional vCPUs'], localName)].{quota:localName, used:currentValue, limit:limit}" -o table

Get your certificate (private access)

One TLS certificate covering all three hostnames, issued by a certificate authority your users' devices trust, as two PEM files:

• The certificate followed by its intermediate certificates.
• The private key, unencrypted.

Keep them for the install wizard. They are uploaded straight into your install and are never sent to Isomer.

3. Isomer confirms you're ready

Once its side is set up, Isomer adds your subscription to the offer's private plan, which makes the offer visible in your Azure Marketplace, and sends you the organization name to enter in the wizard. Enter it exactly as given.

Ready to install

You are ready when:

• Isomer has confirmed your subscription is on the private plan and sent you your organization name.
• EncryptionAtHost shows Registered.
• All three quotas are at least what the install needs.
• For private access, you have your two certificate files.

Next steps