Azure services, data & security

Contents

1How AI Pulse is deployed

AI Pulse is delivered as an Azure Marketplace Managed Application. When you install it, it deploys entirely into your own Azure subscription — a single, self-contained set of resources in one resource group. There is no shared multi-tenant service: each customer runs their own isolated instance.

AI Pulse then reads signals from the AI and security services already in your environment (read-only) to build its governance dashboards. It does not run your AI models, and it does not move your data out of your tenant. Isolation is by deployment boundary — your instance, your subscription, your identity.

2Prerequisites

Have these ready before installing. Items marked optional only affect specific dashboards, which show an honest "not connected" state until enabled.

• An Azure subscription to deploy into.
• Install rights: the person running the install must be Owner or User Access Administrator on that subscription (required to grant the app's identity its read-only roles).
• Entra (Azure AD) rights to create one app registration for sign-in, and to grant the app's managed identity its Microsoft read-access (Privileged Role Administrator, for the one post-install step).
• An existing Azure OpenAI resource in the subscription (AI Pulse reads its configuration; it does not call the model).
• The AI Pulse Gateway URL + key and your subscription key, both provided by SYLVA when you subscribe.
• optional Microsoft 365 E5 / Copilot — for Copilot usage and Microsoft Purview governance signals.
• optional Microsoft Sentinel / Log Analytics + Defender for Cloud — for the deep security-telemetry widgets.
• optional Azure AI Content Safety resource — for prompt-shield and harm-analysis coverage.

3What gets created in your tenant

A single resource group containing these resources — all standard, all in your subscription:

4Azure & Microsoft services it reads

Every connection below is read-only. This is the telemetry AI Pulse gathers and what each signal powers in the product.

5Permissions it needs (and why)

AI Pulse follows least-privilege: it only ever asks for read access, and never gets Contributor, Owner, or user-admin rights. Permissions fall into three groups.

Granted automatically during install (Azure roles)

Granted in one post-install step (Microsoft Graph, read-only)

Granted to the app's managed identity after deployment (the identity doesn't exist until then). All read-only:

Optional — you grant only if you want the matching widget

• Monitoring Reader · Security Reader · Log Analytics Reader · Sentinel Reader — for the Defender, Sentinel, and deep-log security widgets.
• Content Safety resource + key — for prompt-shield / harm-analysis coverage.
• Microsoft 365 E5 connectors — for Copilot-usage and Purview governance signals.

6Data residency & isolation

Your data stays in your tenant. Here is exactly how — stated plainly, including the one nuance.

• Single-tenant by deployment. Every customer runs a separate instance in their own subscription. Nothing is shared between customers — not the app, not the database, not the secrets.
• No standing vendor access. There is no hidden SYLVA support account and no back-door into your deployment. Administration is through your own Entra sign-in.
• Your data doesn't leave. Signals AI Pulse reads are processed and stored inside your tenant. AI-usage tracing runs on the Langfuse instance deployed in your own subscription — not a SYLVA service.
• Personal data is never copied out. The in-tenant scan for exposed personal data records counts and types only — it never stores or transmits the underlying content.

7Installation at a glance

A typical install is five steps. SYLVA can run these with you.

1. Register sign-inRun the connector script once — it creates the Entra sign-in app and records who the first administrator will be.
2. Deploy from MarketplaceLaunch AI Pulse from Azure Marketplace and complete the short wizard (region, a database password, your gateway and subscription keys).
3. Point sign-in at the appRun the redirect-URI script with the address the deployment produced, so single sign-on works.
4. Grant the read-accessRun the Graph-access script once so the identity, licence, audit, and shadow-AI widgets light up.
5. First sign-inThe first administrator signs in and completes the in-product setup wizard.

8What works out of the box

9The full documentation set

This overview is the anchor document. A complete customer pack usually adds the pieces below — we can produce each on request.