Prerequisites
Last updated: 20 September 2026
Goal: Confirm your organization can deploy and configure Sandman before starting the Marketplace install.
You will need:
- An Azure subscription where your VMs live, with permission to create a VM and assign network rules.
- A Microsoft Entra ID app registration for user sign-in.
- An SSH public key for the appliance VM (password login is disabled). Day-to-day administration can be done from the Azure Portal — see Recover admin access.
Network requirements
| Direction | Port / endpoint | Required | Notes |
|---|---|---|---|
| Inbound | 443 (HTTPS) | Yes | Dashboard and API from your allowlisted CIDR ranges |
| Inbound | 22 (SSH) | Recommended | Admin CIDR ranges only; break-glass access |
| Inbound | 8091 | Setup / maintenance only | Setup wizard; deny by default in the template |
| Outbound | Azure Resource Manager | Yes | Start, stop, and discover VMs |
| Outbound | Microsoft Entra ID / Graph | Yes | Sign-in and directory sync |
| Outbound | Let’s Encrypt | Optional | Automatic TLS; upload a certificate if blocked |
| Outbound | Teams Logic App URL | Optional | Shift-end notifications |
Expected result: Your Azure admin can create the VM, reach HTTPS on port 443 from approved networks, and complete the Entra prerequisites.