Setup wizard

Last updated: 20 September 2026

Goal: Complete first-run configuration and start the Sandman service.

After the Entra prerequisites, open the VM’s public address in a browser. Sandman opens the setup wizard. Provide:

  • Azure tenant ID, subscription ID, and sign-in app client ID
  • Admin app role value(s) and/or admin group Object ID(s)
Setup wizard — Azure IDs and admin authorization fields.
Figure 3. Setup wizard — first-run configuration before the main dashboard is available.

When setup completes, Sandman serves HTTPS at the server’s public IP with a temporary self-signed certificate. Sign in as an admin, then configure hostname and trusted TLS in Settings.

Verify: The wizard reports success, https://<public-ip>/ loads the sign-in page, and admin sign-in succeeds.

For IT admins: what happens under the hood
  • First boot prepares the data disk, database, and session store before the wizard opens.
  • The setup wizard is reachable on port 8091 during initial configuration — restrict it with NSG allowlists. Do not enter sign-in client secrets; authentication uses the Entra federated credential.
  • The wizard saves appliance configuration, enables HTTPS with a temporary certificate, and starts the main Sandman service.
  • The setup wizard is not available in normal operation. Use Recover admin access to re-open maintenance mode.
  • Service logs are under /var/log/sandman/.

© 2026 Sandman