Customer-owned deployment

Run KontexIQ inside your Azure subscription

Private Azure Deployment is for teams that want KontexIQ's User Story analysis, test intelligence, and RBT workflow without storing project data in KontexIQ-hosted infrastructure.

Download private package See install steps Request setup review

Customer owns

API and UI resources
PostgreSQL database, vectors, and embeddings
Azure DevOps connector credentials
Azure OpenAI or OpenAI keys
Logs and diagnostics

How users choose it

Presented as a data mode during project initialization

In KontexIQ, users choose a security/data mode before connecting project data. Private Azure Deployment is the choice for enterprise teams that need a customer-owned data plane.

Choose Private Azure Deployment

The Initialize Project wizard explains that no project data will be imported into hosted KontexIQ.

Deploy KontexIQ in Azure

The customer runs the Bicep and PowerShell package with their Azure identity and subscription.

Connect project sources

Azure DevOps, Microsoft SharePoint documents, Git, tests, and other project data connect to the customer's private KontexIQ API.

Install the ADO extension

The Azure DevOps extension is packaged with the customer's private UI and API URLs.

Architecture

Same KontexIQ product, customer-owned Azure data plane

KontexIQ ships versioned API, UI, database migration, and extension artifacts. The customer deploys them into their subscription and controls when updates are applied.

UserKontexIQ UI and Azure DevOps extension

Customer AzureApp Service API, Static Web App, Key Vault, PostgreSQL, App Insights

AI providerCustomer Azure OpenAI deployment or customer OpenAI key

Project systemsAzure DevOps, SharePoint documents, repos, tests, pipelines, incidents

Install path

What the customer runs

Customers do not need repository access. Download the private deployment ZIP, unzip it, and run the included Bicep and PowerShell scripts with Azure CLI access. The ZIP includes the deployable KontexIQ API package, static UI files, database SQL, and deployment scripts.

Download kontexiq-private-deploy.zip

1. Download and unzip

Download kontexiq-private-deploy.zip, unzip it on an admin workstation or build agent, then open PowerShell in the unzipped folder. The customer does not need KontexIQ source code.

Expand-Archive .\kontexiq-private-deploy.zip -DestinationPath .\kontexiq-private-deploy
cd .\kontexiq-private-deploy

2. Prepare Azure

Create or select a subscription, choose regions, confirm Azure OpenAI or OpenAI access, and decide whether a DBA admin IP should be temporarily allowed.

3. Deploy infrastructure

.\private-deploy\scripts\deploy-private.ps1 `
  -ResourceGroupName "rg-kontexiq-private" `
  -EnvironmentName "prod" `
  -AiProvider "azure_openai" `
  -AzureOpenAiEndpoint "https://contoso-openai.openai.azure.com" `
  -AzureOpenAiDeployment "kontexiq-gpt"

4. Apply database schema

.\private-deploy\scripts\migrate-db.ps1 `
  -PostgresServerName "<postgres-server-name>"

5. Deploy API and UI

These commands deploy the compiled API ZIP and static UI files already included in the release bundle.

.\private-deploy\scripts\deploy-api.ps1 `
  -ResourceGroupName "rg-kontexiq-private" `
  -ApiAppName "<api-app-name>"

.\private-deploy\scripts\deploy-ui.ps1 `
  -ResourceGroupName "rg-kontexiq-private" `
  -StaticWebAppName "<static-web-app-name>" `
  -ApiBaseUrl "https://<api-app-name>.azurewebsites.net"

6. Validate deployment

.\private-deploy\scripts\validate-private-deploy.ps1 `
  -ApiBaseUrl "https://<api-app-name>.azurewebsites.net" `
  -UiUrl "https://<static-web-app-host>"

7. Package the Azure DevOps extension

.\private-deploy\scripts\package-ado-extension.ps1 `
  -KontexIQUrl "https://<static-web-app-host>/app.html" `
  -ApiBaseUrl "https://<api-app-name>.azurewebsites.net"

Security posture

Designed for enterprise review

The first private package prioritizes transparency and customer control. Customers can inspect the Bicep, scripts, app settings, and migration steps before deployment.

No KontexIQ-hosted project data

Project context, SharePoint requirement documents, embeddings, vectors, generated intelligence, connector credentials, and logs stay in the customer's Azure resources.

Customer-owned AI keys

Azure OpenAI is recommended. Standard OpenAI is supported as a fallback. Keys are stored in customer Key Vault.

No telemetry by default

Private deployment does not send project data or diagnostics back to KontexIQ unless the customer explicitly exports information for support.

Customer-pulled updates

KontexIQ publishes versioned artifacts. The customer reviews and applies API, UI, extension, and migration updates when approved.

Auditable database changes

Schema updates are script-driven and explicit. The API does not silently apply private deployment migrations on startup.

Delete by deleting resources

Customers can remove private deployment data by deleting the customer-owned resource group or following their internal retention process.

MCP and private data

Hosted MCP is not enabled for private deployment data

The hosted KontexIQ MCP endpoint is designed for hosted KontexIQ projects. Private Azure deployments should not route customer-owned project data through hosted MCP. Customers that need Copilot or agent access to private KontexIQ data should deploy a customer-owned MCP service in their Azure subscription.

Current private package

The v1 private deployment package deploys API, UI, PostgreSQL, Key Vault, monitoring, database scripts, and the Azure DevOps extension. It does not deploy MCP runtime yet.

Recommended enterprise path

Add a customer-owned MCP App Service that calls the private KontexIQ API and uses the customer's Entra app registration and tenant policy.

Hosted MCP docs

For hosted KontexIQ users, use the public MCP setup page and endpoint.

Read hosted MCP setup

Future private package update

Private MCP should add Bicep resources, deployment scripts, app settings, validation checks, and customer Entra instructions before it is bundled.

Common questions

What enterprise users usually ask

Does KontexIQ support access exist by default?

No. The private deployment is customer-operated. Support starts from customer-shared diagnostics or a customer-approved access path.

Is this Azure Marketplace managed app?

Not in v1. The first package is Bicep plus scripts so security teams can inspect and run it directly.

Can this run with private endpoints later?

Yes. The first template uses secure public endpoints. A VNet/private endpoint template is a planned enterprise hardening path.

How do updates work?

Customers pull approved KontexIQ releases, run migration scripts, deploy API/UI artifacts, and update the extension when needed.

Ready for a private review?

Bring KontexIQ to your Azure subscription

We can walk your Azure admin, security reviewer, and ADO owner through the package and first deployment path.

Request private deployment review