Environment
Goal: Know what each Environment window sets up, what it needs first, and where the other windows are.
The Environment menu in the top bar is where a workspace gets its own place in Azure. Each item opens a window that sets up one thing in your Azure subscription. Those windows are not the canvas: each acts with its own button, not the canvas Save - Save & Provision in Data & IoT Fabric and Databases, Save configuration in Provenance, Connect Subscription in Cloud Connections, Provision Landing Zone in Manage Private CALZ (each window's button is listed below). That button acts straight away; it does not wait for Deploy.
The order things unlock in
The Environment items unlock in a fixed order. An item that is not available yet is left out of the menu, not greyed out.
| Step | Menu item | Shows when |
|---|---|---|
| 1 | Cloud Connections | Always |
| 2 | Manage Private CALZ | The workspace has a connected cloud |
| 3 | Data & IoT Fabric | The workspace has a connected cloud and a provisioned private landing zone |
| 3 | Databases | The same |
| 3 | OEM Integrations | The same, and you hold the Workspace.Experimental right |
| 3 | Provenance | A connected cloud and a provisioned private landing zone |
| 3 | App Identity | The same |
| 3 | Communications | The same |
The menu lists them in that order. Manage Private CALZ needs only the cloud, because it is the window that creates the landing zone.
What "connected" and "provisioned" mean
Both are read from what the workspace has stored, never by asking Azure, so the menu does not depend on a network call:
- A connected cloud is a stored cloud connection whose application id, secret, subscription id and tenant id are all filled in. A managed subscription counts once it is set up and those four are filled in.
- A provisioned landing zone is a stored landing zone whose region, resource group, storage account and Key Vault are all recorded. Log Analytics and Application Insights are optional and do not count.
When something is not available yet
The menu hides such a window, but a request for a kind that needs the landing zone - through the API, over
MCP, or as a proposal - is answered with the code
PRIVATE_LANDING_ZONE_REQUIRED and the sentence "This needs a private landing zone, which this workspace does
not have yet." The next step it names depends on what is missing: with no connected cloud, connect a cloud
from Environment -> Cloud Connections, then create the landing zone from Environment -> Manage Private
CALZ; with a cloud, only the second.
An AI connected over MCP sees the same chain. get_workspace lists each kind that is not active yet under
Capabilities.InactiveKinds, with its code, reason, next step and Requires - the record kinds still missing,
in setup order (for example Clouds, then CALZ).
The badges on the menu
A number on an item means something there is waiting for you. The closed Environment menu shows the sum.
| Item | Counts |
|---|---|
| Cloud Connections | Stored clouds whose credential is close to expiry or expired, plus pending Cloud proposals |
| Manage Private CALZ | Pending landing zone proposals |
| Data & IoT Fabric | Pending proposals, a stopped cluster, a hub at 80% or more of today's message quota, and each setup piece left unfinished |
| Databases | Pending account proposals |
| Provenance | Pending Provenance proposals |
| App Identity | Pending access-right and access-configuration proposals |
Communications and OEM Integrations carry no badge.
The windows
| Window | Sets up | Its button |
|---|---|---|
| Cloud Connections | The Azure subscription your workspace runs in | Connect Subscription, Create Subscription, or the managed subscription's Yes, create the subscription |
| Manage Private CALZ | Your private landing zone: a resource group, storage and a Key Vault of your own | Provision Landing Zone |
| Data & IoT Fabric | Where device data arrives and is stored and queried | Save & Provision |
| Databases | CosmosDB accounts for documents | Save & Provision |
| OEM Integrations | A preview with sample data | None |
| Provenance | The record of changes, its retention and signing | Save configuration |
| App Identity | Sign-in for the apps you deploy, and the access rights they use | Save Provider, and Save on its other tabs |
| Communications | Outbound email through an SMTP relay you supply | Save relay |
| Deploy | Opened from Deploy in the top bar: builds and removes what you saved | Deploy |
TIP
Most setup windows build Azure resources when you press their button, and those bill to your Azure subscription. Save relay in Communications builds nothing: it stores the relay settings and puts the password in your Key Vault. Canvas changes are different: they are built by Deploy. See Save, accept and Deploy.
Proposals in the Environment windows
Azi and agents can propose most Environment records; a person accepts. Any workspace member can accept a proposal; some changes (access, licences, connected-app requests) need a management right. Accepting writes the record to the workspace; the window's own button, or Deploy, is what builds it in Azure. Each window's page says what can be proposed there and where you accept it. In Greenfield, Azi's own proposals are accepted for you; the window's button or Deploy still does the building.
Azi, or an agent connected over MCP, can propose a cloud connection and, once a cloud is connected, a landing
zone. A proposal never carries a credential (CREDENTIAL_IN_PROPOSAL). Proposing is not connecting or creating:
a person accepts in the window, by doing their part there. In
Cloud Connections the proposal shows over the normal Connect form,
filled from it, and Accept proposal and Connect accepts it, then connects with what the form holds; a cloud
proposal accepted anywhere else is saved, not connected, until the person connects it there. Accept Proposal and
Create in
Manage Private CALZ records it, then starts the window's own create.
In Greenfield, Azi's own cloud connection or landing zone proposal is accepted for you, which only records it;
Azi then names the window where you connect or create it.
The kinds that need the landing zone (Provenance, IoT, Data Stores, Communications, App Identity) can be
proposed only once the cloud is really connected and the landing zone created. Until then get_workspace lists
them under InactiveKinds with Requires, and a proposal for one, even in the same bundle as the cloud
connection or landing zone, is refused PRIVATE_LANDING_ZONE_REQUIRED: a proposal cannot connect or create.
Other windows
| Menu or place | Window |
|---|---|
| Workspace -> Settings | Workspace Settings |
| Workspace -> Team Members | Team Members |
| Workspace -> Alerting | Alerting |
| Workspace -> View All... | Manage Workspaces |
| Workspace -> Manage Fathym Workspace | Manage Fathym Workspace |
| fAI -> Manage Remote Connection | fAI Remote Connection |
| APIs -> API Keys | API Keys |
| APIs -> API Manager | API Manager |
| APIs -> OpenX MCP Server | MCP Server |
| Licenses -> Manage Licenses | Licenses |
| Billing -> Current License | Current License |
| Manage Profile in the top bar | Account Profile |
Next steps
- Start at the first step -> Cloud Connections
- What Save, accept and Deploy each do -> Save, accept and Deploy
- How proposals work -> Proposals