> ## Documentation Index
> Fetch the complete documentation index at: https://clickhouse.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Private Preview

> Onboard ClickHouse BYOC on Azure using the Terraform module and cross-tenant authentication

export const PrivatePreviewBadge = () => {
  return <div className="privatePreviewBadge">
            <div className="privatePreviewIcon">
            <svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">
                <path d="M5.33301 6.66667V4.66667V4.66667C5.33301 3.194 6.52701 2 7.99967 2V2C9.47234 2 10.6663 3.194 10.6663 4.66667V4.66667V6.66667" stroke="currentColor" strokeLinecap="round" strokeLinejoin="round" />
                <path d="M8.00033 9.33337V11.3334" stroke="currentColor" strokeLinecap="round" strokeLinejoin="round" />
                <path fillRule="evenodd" clipRule="evenodd" d="M11.333 14H4.66634C3.92967 14 3.33301 13.4033 3.33301 12.6666V7.99996C3.33301 7.26329 3.92967 6.66663 4.66634 6.66663H11.333C12.0697 6.66663 12.6663 7.26329 12.6663 7.99996V12.6666C12.6663 13.4033 12.0697 14 11.333 14Z" stroke="currentColor" strokeLinecap="round" strokeLinejoin="round" />
            </svg>
        </div>
            {'Private preview in ClickHouse Cloud'}
        </div>;
};

<PrivatePreviewBadge />

<Note>
  BYOC on Azure is in **private preview**. To participate, [contact the ClickHouse team](https://clickhouse.com/cloud/bring-your-own-cloud).
</Note>

<h2 id="overview">
  Overview
</h2>

BYOC on Azure lets you run ClickHouse in your own Azure subscription. Onboarding uses a Terraform module that provisions the cross-tenant authentication required for ClickHouse Cloud's provisioner to create and manage Azure resources in your tenant and subscription.

Other aspects of the deployment—such as [architecture](/docs/products/bring-your-own-cloud/overview/architecture), [network security](/docs/products/bring-your-own-cloud/reference/network-security), [features](/docs/products/cloud/guides/infrastructure/deployment-options/byoc/overview#features), and [connectivity](/docs/products/bring-your-own-cloud/configuration/connect)—are broadly similar to the AWS and GCP BYOC offerings; refer to those pages for more details.

<h2 id="prerequisites">
  Prerequisites
</h2>

* An Azure **subscription** and **tenant** where you want to host the BYOC deployment
* The **subscription ID** and **tenant ID** to share with the ClickHouse team

<h2 id="onboarding">
  Onboarding
</h2>

<Steps>
  <Step title="1. Apply the Terraform module" id="apply-terraform-module">
    To start BYOC Azure onboarding, apply the [Terraform module for Azure](https://github.com/ClickHouse/terraform-byoc-onboarding/tree/main/modules/azure) provided by ClickHouse in your **target tenant and subscription**.

    Use the module's documentation for required variables and apply steps. After applying, the module will have set up the necessary identity and permissions in your Azure environment.
  </Step>

  <Step title="2. Provide IDs to ClickHouse" id="provide-ids">
    Share the following with the ClickHouse team:

    * **Target subscription ID** — The Azure subscription where BYOC resources will be created
    * **Target tenant ID** — The Azure AD (Entra) tenant that owns that subscription
    * **Region** — The Azure regions where you want to deploy your ClickHouse services.
    * **VNet CIDR range** — The IP address range you would like used for the BYOC VNet.

    The ClickHouse team will use these to create the BYOC infrastructure and complete the onboarding
  </Step>
</Steps>

<h3 id="cross-tenant-auth">
  How cross-tenant authentication works
</h3>

Following [Azure guidance for cross-tenant authentication](https://learn.microsoft.com/en-us/entra/identity-platform/single-and-multi-tenant-apps), the Terraform module:

1. **Provisions a multi-tenant application** as an **Enterprise Application** (service principal) in your target tenant
2. **Assigns the required permissions** to that application, scoped to your target subscription

This allows the ClickHouse Cloud Control Plane to create and manage Azure resources (such as resource groups, AKS, storage, and networking) within your subscription, without storing your Azure credentials in ClickHouse.

For more detail on multi-tenant apps and cross-tenant scenarios in Azure, see:

* [Single and multi-tenant apps in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity-platform/single-and-multi-tenant-apps)
* [Authorize cross-tenant access (Azure SignalR example)](https://learn.microsoft.com/en-us/azure/azure-signalr/signalr-howto-authorize-cross-tenant)