Service Description¶
This page describes what the Agentic Developer Portal offers, what each feature needs before it shows data, and where the service ends. The names, defaults and schedules are those of the reference design; your platform may differ. Ask your platform team which features are switched on in your environment.
The service in short¶
| Aspect | Description |
|---|---|
| Delivery | One portal per customer environment (usually non-production and production), deployed in the customer's own Azure subscriptions |
| Code base | One shared code base and one container image for all customers. Features are enabled by configuration, not by customer-specific code. |
| Updates | New versions are released for all customers and rolled out environment by environment (Deployment and environments) |
| Data | All data that the portal collects, processes and stores stays in the customer's Azure subscriptions (Architecture) |
| Users | People of the customer's Entra ID tenant who belong to the allowed groups (Authentication and access) |
| Cost | The Azure resources of the portal run on the customer's Azure bill. Features such as cost insights and AI agents add resources and therefore spend. |
Features¶
| Feature | What the user sees | Needs | Page |
|---|---|---|---|
| Workloads and domains | Explorer pages for workloads and domains, entity pages with owner, domain, dependencies and subscriptions | Subscriptions tagged with a workload and an owner, and users and groups from Entra ID | Catalog and entity model |
| Organisation view | A page for organisations (customers) and their domains | Feature flag features.organisation |
Catalog and entity model |
| Cost insights | Monthly cost per subscription, workload, team and domain | Cost insights resources and cost exports (Cost insights setup) | Insights |
| Network insights | Blocked firewall requests, Application Gateway access and WAF logs on the workload page | Azure Firewall and Application Gateway diagnostics in Log Analytics | Insights |
| Security insights | Secure score and recommendations | Microsoft Defender for Cloud on the subscriptions | Insights |
| Compliance insights | Compliance matrix per regulatory standard | Regulatory compliance initiatives assigned with Azure Policy | Insights |
| AI agents | A chat page with the enabled agents | An Azure AI Foundry account and agent configuration (AI setup) | AI agents |
| MCP server and inspector | A server for editors and agents, and a page to try its tools | Always present; access by token or sign-in | MCP server |
| Module registry | List, detail and download of Terraform modules | Feature flag features.moduleRegistry and a registry API |
Module registry |
| Documentation (TechDocs) | Documentation pages of services whose repository contains an mkdocs.yml |
See the note below | |
| Software templates (Create) | Templates for standard changes | Feature flag features.scaffolder, provider environment only |
Configuration |
Features differ per environment
The delivery documents of the source state that every customer gets the full feature set of the deployed version. The code, however, enables several features by configuration (feature flags, a connected cost database, agent settings). Treat the table as "what exists" and ask your platform team "what is on in my environment". Describe to your users only what is actually deployed.
TechDocs
The TechDocs backend is part of the portal, and the delivery material lists TechDocs among the self-service capabilities. A feature flag in the code switches the documentation entry on only for the provider's own environment and for local development. Confirm with your platform team whether TechDocs is enabled for you.
Data the portal handles¶
| Data | Source | Stored where |
|---|---|---|
| Catalog entities, relations, agent conversations, security and compliance results, network inventory | Azure Resource Graph, Azure DevOps, Microsoft Graph (Entra ID), the portal itself | The portal's PostgreSQL database in the customer environment |
| Cost data | Azure Cost Management exports, ingested by Azure Data Factory | Storage accounts and an Azure SQL database in the customer environment |
| Firewall and WAF log lines | Log Analytics workspaces of the customer | Queried on demand, not copied permanently |
| Secrets and keys of the portal | Created by Terraform and the deployment pipeline | The environment's Key Vault |
The model that answers agent prompts is served from the customer's own Azure AI Foundry account. Conversation history is kept in the portal's PostgreSQL database, not in Foundry.
What the service does not do¶
- No changes to Azure resources. The portal reads. Agents and the MCP tools prepare pull requests in repositories; they do not merge them.
- No customer-specific code. A request that needs a feature for one customer is handled as separate work and decided by the solution lead of the provider. It does not change the shared code base for one customer.
- No data outside the customer environment. The provider does not copy customer data to its own environment.
- No coverage outside the readable scope. The portal shows only subscriptions its managed identity can read. A subscription outside the granted management group is not visible.
- No contract terms in these pages. Support hours, response times and service levels follow your agreement. The delivery material of the source notes that the wording of the operational guarantee and of the offboarding position is still to be confirmed. These pages do not state either.
Responsibilities¶
| Platform team | Workload team | |
|---|---|---|
| Deploy, update and monitor the portal | Yes | |
| Grant the portal read access in Azure, Entra ID and repositories | Yes (customer administrators approve) | |
| Keep the data sources healthy (Defender for Cloud, policy assignments, diagnostics, cost exports) | Yes, for platform-owned parts | For workload-owned resources |
| Tag subscriptions with workload and owner | Yes, for spokes the platform deploys | For tags the platform does not set |
| Own workloads in the catalog, act on recommendations and policy findings | Yes | |
| Review pull requests prepared by agents | Yes, for platform configuration | Yes, for repositories the team owns |
The generic split is in Responsibilities.