Azure Marketplace

Deploy the Broch appliance into your own Azure subscription from a guided form in the Azure portal.

Before You Deploy

An Azure subscription with Contributor on the resource group you deploy into. Azure DNS with a managed identity also needs Owner or User Access Administrator on the zone’s resource group, because the template grants that identity a DNS role. With only Contributor, choose the service principal option instead.
A DNS zone you control on Azure DNS, Cloudflare, Route 53 or Google Cloud DNS (experimental). An Azure DNS zone must be in the subscription you deploy into. Broch serves broch.{your-domain} and every tunnel URL under *.broch.{your-domain}, with a certificate it issues and renews itself. Or bring your own certificate covering both names; renewing it is then up to you.
An identity provider app: a web (confidential) client with the redirect URI https://broch.{your-domain}/auth/callback. Note its client ID and secret, a role your first admin holds, and your provider’s own values: domain (Auth0, Okta), API Identifier (Auth0), tenant ID (Entra ID) or issuer URL (generic OIDC). See Auth0, Entra ID, Okta or Generic OIDC.
A master key: openssl rand -base64 48. Keep it in your own secret store and supply the same value on every redeploy.
An email address for your Let’s Encrypt account, required even with your own certificate.
Connecting to your own PostgreSQL? Create its database and least-privilege role first, as in the template’s Database setup.

From the listing, choose Get It Now, then Create. After Basics (subscription, resource group and region), the form has five tabs:

Tab	What it asks
Application	Your DNS zone (`{your-domain}`), the subdomain (default `broch`, giving `broch.{your-domain}`), your master key, and the Broch version, a pinned release by default.
Identity provider	Provider, client ID and secret, your provider’s own field (tenant ID for Entra ID, domain for Auth0 and Okta, issuer URL for generic OIDC), and Admin roles (default `broch_admin`): a comma-separated list, one of which your first admin holds. For Auth0, also the API audience.
Database	Create a new database, the default (a private Azure Database for PostgreSQL Flexible Server, with an admin password and a size you choose, B1ms by default), connect to an existing one (a connection string), or run it on this VM (nothing to prepare; you manage backups).
TLS	Automatic certificates through your DNS provider, or bring your own. Your Let’s Encrypt email. DNS A records: Automatic by default, so the appliance creates and maintains them. Choose Manual only when a load balancer or NAT sits in front of the VM, or you manage DNS yourself.
Virtual machine	VM size: `Standard_B2s` by default, `Standard_B1ms` for small teams. SSH stays closed unless you set an SSH allowed CIDR, and a public key gives key-based login; see Operating the Appliance.

Choose Review + create, then Create. First boot takes 3–10 minutes.

Find the public IP in the deployment’s Outputs (publicIpAddress).
Open the database firewall if you connected an existing database: allow the public IP through it.
Check DNS. The appliance creates and maintains the A records for broch.{your-domain} and *.broch.{your-domain}, pointing at the public IP. With Manual A records, your own certificate, or a non-Azure DNS provider whose zone is a delegated subdomain, it creates none; add them yourself, DNS-only rather than proxied:
```
A   broch.{your-domain}     → <public-ip>
A   *.broch.{your-domain}   → <public-ip>
```
Check that both names resolve to the public IP (test stands in for any tunnel name):
Terminal window
```
nslookup broch.{your-domain}
nslookup test.broch.{your-domain}
```
The server is ready when https://broch.{your-domain}/healthz returns 200.
Sign in at https://broch.{your-domain} with an account holding an admin role. Setup offers the free trial or a purchase. The trial is free until the 1st of the month, at least 15 days, with a card upfront, first charged on that 1st. There’s no license key to get beforehand. See Licensing & Billing.
Grant access. Share is deny-by-default: add a Share Policy for your developers’ IdP role.
Invite developers. Send them Sharing Local Services to install the CLI and open their first tunnel.

The Broch appliance on one VM, in a resource group you choose. Architecture describes how it fits together.
A static public IP, with ports 80 and 443 open and SSH closed.
PostgreSQL in the mode you chose.
Key Vaults for the deploy-time secrets and, unless you added an SSH key, the break-glass password.
A data disk holding the certificate store and, in the on-VM database mode, the database.
A wildcard certificate, issued and renewed automatically unless you brought your own.
No charge from Broch to deploy; your cloud provider bills the VM and database. After the trial, Broch Share is priced per active user (pricing).

Upgrades, secret rotation, backup and teardown: Operating the Appliance. The Azure CLI deploys the same appliance from the command line.

Next: Share Policies.