Admin Setup in Azure Government

This guide walks your administrator through deploying Defense AI into your company's Azure Government environment. It's a one-time setup. Most companies finish it, including the first users, in about 40 minutes on their onboarding call.

Before you start

You'll need:

• A Global Administrator for your Microsoft Government tenant. Setup can't be completed without one.

• Someone who can assign roles on the Azure subscription (a subscription Owner). This is often the same person.

• A credit card for a new Azure pay-as-you-go subscription. Model usage (tokens) is billed by Microsoft to this subscription.

• Local admin rights on each laptop that will run Claude Desktop, so the app can be installed and updated.

Microsoft's government portal can be slow. If a page hangs, reload it. That's usually all it needs.

Step 1: Accept your invitation and start setup

Your Atomus contact adds your admins in the Defense AI admin portal (ai.atomuscyber.us). Each admin gets an email from Defense AI.

1. Open the email and click Confirm Email.

2. Click Start Setup.

Step 2: Sign in and approve the Defense AI Setup app

1. Sign in to Azure Government with your admin account. If your browser signs you in with a different account, use a private or incognito window.

2. When Microsoft shows the Defense AI Gateway permission request, click Accept.

This lets Defense AI see your Azure subscriptions so it can set up resources and billing for the models.

Step 3: Create a pay-as-you-go subscription

Defense AI runs in its own Azure subscription, so model usage is billed separately from everything else in your tenant.

1. In a new tab, go to portal.azure.us → Subscriptions → Add → Pay-As-You-Go → Select Offer.

2. Complete the form and enter the payment card.

3. Wait for the subscription to appear. This can take up to 5 minutes. Reload Subscriptions and click See All.

Step 4: Connect the subscription

1. Back in the setup tab, click Choose a Subscription and pick your new pay-as-you-go subscription.

2. Click Grant Access, then Verify Access and Continue, then I've Approved It.

Grant access automatically asks someone authorized to assign roles to sign in once. It gives the Setup app the Contributor and User Access Administrator roles on the Defense AI subscription, which it needs to create and manage resources. The portal keeps that one-time sign-in encrypted for no more than ten minutes and deletes it after use. If you prefer, the Setup page also shows the exact Azure CLI commands to assign the roles yourself.

Step 5: Register three resource providers

In portal.azure.us, open the new subscription → Settings → Resource providers. Search for and Register each of these:

• Microsoft.CognitiveServices, which runs the AI models

• Microsoft.KeyVault, which stores the keys

• Microsoft.DBforPostgreSQL, the database for usage records

Step 6: Create resources

In the setup tab, click Create Resources. This usually takes 1–3 minutes.

Step 7: Approve the Access app

Approve the Access app when prompted. This is a separate app from the Setup app. It lets anyone at your company sign in with their work email and get their own Defense AI key.

Step 8: Deploy models

Click Deploy on each available model. As new models are added to Defense AI, they appear here as a one-click deploy.

Step 9: Deploy the gateway

Click Deploy Gateway. This usually takes 10–20 minutes, mostly while the database is created. Keep the setup page open: progress advances while it's open, and if you leave, return to the Setup page to resume. Don't start a second deployment.

The gateway is what issues each person's key, routes requests to your models, and tracks usage. While it deploys, a good use of the time is installing Claude Desktop on each user's laptop.

Step 10: Run the smoke test

Click Run Smoke Test. It confirms each tool and model actually responds through the gateway. If any line shows Not working yet, fix that error and rerun the test before inviting users.

Step 11: Invite users

Go to Setup → People, copy the user link, and share it with your team. Everyone uses this same link to sign in with their work email and get their own key. It's also how you'll onboard future users.

Microsoft 365 access (email, calendar and files) is a separate, optional setup. See the Microsoft 365 article in this collection.

What gets created in your subscription

Setup creates a dedicated resource group containing:

• An Azure OpenAI (Foundry) account for the models

• A Key Vault

• A PostgreSQL Flexible Server for usage records

• A Container Apps environment running the Defense AI gateway

If you set up the hosted Microsoft 365 connector, it runs as a separate Container App in the same environment.

Defense AI creates its own Foundry account rather than reusing an existing one, so its resources stay isolated. Don't delete either one if you already had a Foundry resource. Contact Atomus if you'd like to discuss reusing an existing account.

How long setup takes

These are estimates. Microsoft provisioning and throttling can make any stage take longer. Go by the progress shown on the page rather than elapsed time.