Deploy to your own tenant

Embedded mode runs the dispatch server-side against your Azure OpenAI deployment, behind Entra authentication. That is what makes the squad reachable from Copilot Studio — and what makes it cost money.

This page is the shape of the deployment. The authoritative, copy-paste procedure with every command and parameter is the host/RUNBOOK.md. Follow that; use this page to know what you are getting into first.

What you are deploying

Azure Container Apps — the server itself, scale-to-zero capable, with a user-assigned managed identity.
Azure Container Registry — the image, built in ACR from host/Containerfile.
Azure Key Vault — operator secrets; the app reads them through its managed identity.
Azure OpenAI — the model backend. This is where real spend begins.
An Entra app registration — the resource server whose Application ID URI becomes the token audience.
Optionally Azure Table Storage for durable run state, and Blob Storage for renders and memory overflow.

Everything is expressed as Bicep in host/infra/. There is no click-through path.

The shape of it

Deploy identity. OIDC federation for CI, or a local az login for a manual run.
Register the Entra app and expose the API. The Application ID URI is the audience the server enforces on every token. Expose one scope per tool, plus the Squad.Operate app role for the operator who releases held runs.
Provision Azure OpenAI. Real spend starts here. The endpoint must appear in the server's model-endpoint allow-list, or the server refuses to start.
Fill in the deployment parameters in host/infra/main.bicepparam.
Build the image in ACR and deploy the Container App, Key Vault, and managed identity.
Grant the app identity access to Azure OpenAI — least privilege, no keys in configuration.
Import the connector into Copilot Studio from generated/copilot-studio-connector/, which is generated and committed.

Authentication is non-negotiable

The remote surface is default-deny at three independent layers, and a call must pass all three:

Layer	Rejects
Audience binding	A valid token minted for a different resource. Confused-deputy defence.
Per-tool scope	A token with no explicit scope for the tool being called.
Origin allow-list	Any origin not explicitly listed. `*` is rejected at startup, not at request time.

Tenant isolation is enforced on top: every store path is prefixed by the caller's tenant and traversal-guarded, so one tenant cannot address another's runs, artifacts, or memory. The test/conformance/ suites exist specifically to make a regression in any of this loud.

Releasing a held run

squad_run holds at the Human Gate. Releasing it is an operator action, not a tool call: the holder of the Squad.Operate app role posts to /admin/approve out of band. The approval is recorded with approver and timestamp, and it is tenant-scoped. There is no code path by which caller input or model output can release a gate.

If you want advisory-only runs to proceed unattended, that is a separate, explicit opt-in (SQUAD_MCP_ADVISORY_AUTOPILOT_ENABLED) which narrows the gate to advisory runs — it never removes it for impactful ones. See Configuration.

Single-replica or multi-replica

The async pipeline needs durable run state, and which backend you pick determines whether you can scale:

Backend	Replicas	Trade
`file`	one	A local directory. Simplest to stand up. Approval is only visible to the replica that holds the file, so scale-out silently breaks release.
`table`	many	Azure Table Storage with ETag compare-and-swap. Makes release visible across replicas, which is what makes scale-to-zero safe.

Runs longer than about four minutes exceed the request path. Enable the background worker (an ACA Job) and the status poll becomes read-only while the worker drives approved runs to completion. The worker requires the table backend, for the same reason scale-out does.

Cost

Delegated mode is effectively free — the caller's own model runs the inference. Embedded mode is dominated by server-side inference, which is why hosting is scale-to-zero and why per-tenant concurrency and a per-tenant cost ceiling are first-class settings rather than afterthoughts. Set SQUAD_MCP_TENANT_COST_CEILING_USD before you expose anything to real users.

What this deployment deliberately does not do

It does not write to Azure DevOps, Jira, or GitHub. Ever. A certified native connector does that.
It does not execute code or run a deploy. Embedded mode is advisory: finished text, plus the deterministic .pptx render.
It does not target Microsoft 365 Copilot or Cowork yet.
It does not auto-release a gate under any configuration.

Governed-tenant onboarding

For tenants running Agents 365 governance, the server can be registered as a bring-your-own tool in the tenant catalog, approved in the Microsoft 365 Admin Center, and then consumed from Copilot Studio as an approved tool. The runbook covers the CLI registration, the admin approval, and the consumption step.