Azure Private Preview

[Edit this page](https://github.com/ClickHouse/clickhouse-docs/blob/main/docs/cloud/guides/infrastructure/01_deployment_options/byoc/03_onboarding/05_azure_private_preview.md)

Private preview

Note

BYOC on Azure is in **private preview**. To participate, [contact the ClickHouse team](https://clickhouse.com/cloud/bring-your-own-cloud).

## Overview[​](#overview "Direct link to Overview")

BYOC on Azure lets you run ClickHouse in your own Azure subscription. Onboarding uses a Terraform module that provisions the cross-tenant authentication required for ClickHouse Cloud's provisioner to create and manage Azure resources in your tenant and subscription.

Other aspects of the deployment—such as [architecture](/docs/cloud/reference/byoc/architecture), [network security](/docs/cloud/reference/byoc/reference/network_security), [features](/docs/cloud/reference/byoc/overview#features), and [connectivity](/docs/cloud/reference/byoc/connect)—are broadly similar to the AWS and GCP BYOC offerings; refer to those pages for more details.

## Prerequisites[​](#prerequisites "Direct link to Prerequisites")

- An Azure **subscription** and **tenant** where you want to host the BYOC deployment
- The **subscription ID** and **tenant ID** to share with the ClickHouse team

## Onboarding[​](#onboarding "Direct link to Onboarding")

1. Apply the Terraform module

### 1. Apply the Terraform module[​](#apply-terraform-module "Direct link to 1. Apply the Terraform module")

To start BYOC Azure onboarding, apply the [Terraform module for Azure](https://github.com/ClickHouse/terraform-byoc-onboarding/tree/main/modules/azure) provided by ClickHouse in your **target tenant and subscription**.

Use the module's documentation for required variables and apply steps. After applying, the module will have set up the necessary identity and permissions in your Azure environment.

2. Provide IDs to ClickHouse

### 2. Provide IDs to ClickHouse[​](#provide-ids "Direct link to 2. Provide IDs to ClickHouse")

Share the following with the ClickHouse team:

- **Target subscription ID** — The Azure subscription where BYOC resources will be created
- **Target tenant ID** — The Azure AD (Entra) tenant that owns that subscription
- **Region** — The Azure regions where you want to deploy your ClickHouse services.
- **VNet CIDR range** — The IP address range you would like used for the BYOC VNet.

The ClickHouse team will use these to create the BYOC infrastructure and complete the onboarding

### How cross-tenant authentication works[​](#cross-tenant-auth "Direct link to How cross-tenant authentication works")

Following [Azure guidance for cross-tenant authentication](https://learn.microsoft.com/en-us/entra/identity-platform/single-and-multi-tenant-apps), the Terraform module:

1. **Provisions a multi-tenant application** as an **Enterprise Application** (service principal) in your target tenant
2. **Assigns the required permissions** to that application, scoped to your target subscription

This allows the ClickHouse Cloud Control Plane to create and manage Azure resources (such as resource groups, AKS, storage, and networking) within your subscription, without storing your Azure credentials in ClickHouse.

For more detail on multi-tenant apps and cross-tenant scenarios in Azure, see:

- [Single and multi-tenant apps in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity-platform/single-and-multi-tenant-apps)
- [Authorize cross-tenant access (Azure SignalR example)](https://learn.microsoft.com/en-us/azure/azure-signalr/signalr-howto-authorize-cross-tenant)

- [Overview](#overview)- [Prerequisites](#prerequisites)- [Onboarding](#onboarding)
      - [1. Apply the Terraform module](#apply-terraform-module)- [2. Provide IDs to ClickHouse](#provide-ids)- [How cross-tenant authentication works](#cross-tenant-auth)

Was this page helpful?