Manage Private CALZ

Goal: Give your workspace its own landing zone in your Azure subscription.

A landing zone (CALZ) is the workspace's own base in your Azure subscription: a resource group with a storage account and a Key Vault, plus optional logging. Once it exists, the rest of the Environment menu appears - Data & IoT Fabric, Databases, Provenance, App Identity and Communications - and the next Deploy moves what it can from the shared environment into your private cloud.

The menu item is Manage Private CALZ; the window is titled Private Open Industrial CALZ.

Before you start

• A connected cloud - see Cloud Connections. Until then the menu has no Manage Private CALZ.

When the window opens with a connected cloud and no landing zone, it registers the Azure resource providers the workspace needs in your subscription ("Registering Azure providers..."). That never blocks the form.

Provision the landing zone

Field	What it is
Resource Group Name	Read only. Named for this workspace: "This is permanent: a resource group cannot be renamed once the landing zone is provisioned."
Region	Pick one ("Pick a region..."). The list comes from your subscription. There is no default

Click Provision Landing Zone. While it runs, the window lists each resource as it is created: "Provisioning your landing zone. This usually takes a few minutes, and these update when it finishes."

What it creates, all in your Azure subscription inside that resource group:

Resource	What you get
Storage account	General-purpose state for this workspace
Key Vault	This workspace's own secrets, rather than a vault shared across customers
Log Analytics workspace	Diagnostics and query history. Optional
Application Insights	Attached to that Log Analytics workspace. Optional

"Optional means the workspace runs without it. These two are diagnostics - if they are missing you lose query history and telemetry, and nothing else stops working."

Once it is provisioned

The window shows a status sentence, the six recorded values (resource group, region, storage account, Key Vault, Log Analytics, Application Insights) and, each time it opens, a check that they still exist in Azure ("Checking these still exist in Azure..."). Each resource then reads live, gone from azure, broken link or could not check - and "could not check" does not mean it is missing.

Status sentence
Not set up — no landing zone is recorded for this workspace yet.
Started — a region and resource group are recorded, but no storage account yet.
Partly set up — storage is recorded, but no Key Vault, so this workspace cannot hold its own secrets.
Ready — storage and a Key Vault are recorded. Logging and App Insights are not set up, which is optional.
Set up — storage, Key Vault and logging are all recorded for this workspace.

Two buttons run provisioning again, against the region and resource group already recorded:

Button	When	What it does
Finish provisioning	Some of the six values are missing	Creates only what is missing; it will not move or recreate anything
Re-run provisioning	Everything is recorded	"Safe to run" - it creates only what is missing

If you would like help, the window says: "Want it faster? Email support@fathym.com and the team will help provision it today."

Save and Deploy

This window has no Save; its own buttons do the work. Provision Landing Zone, Finish provisioning and Re-run provisioning each start a commit that provisions in Azure at once, and the window follows it in its Latest deployment panel. They do not wait for Deploy. While it runs, another setup window's save and a Deploy are refused (DEPLOY_IN_PROGRESS), and a canvas Save is refused while the commit is still queued. A partly provisioned landing zone is kept, not discarded: each resource row says which part did not finish, and Finish provisioning creates the rest.

After the landing zone exists, the next Deploy moves records that were deployed to the shared environment into your private cloud; the Deploy review lists them as moving. See Deploy.

A landing zone is never removed: "Your landing zone holds the data archives of everything removed from this workspace, so it outlives every other removal."

Rights

No access right is checked for provisioning beyond being in the workspace. It runs in the subscription your cloud connection names.

Azi and agents

Azi, or an agent connected over MCP, can propose a landing zone once a cloud is connected: its name and description, and its region and resource group only while nothing is provisioned. Before a cloud is connected the kind is not on yet, and get_workspace lists it with CLOUD_CONNECTION_REQUIRED.

Code	When
REGION_NOT_A_SLUG	The region must be the Azure region's slug, such as eastus2, never its display name
CALZ_ALREADY_PROVISIONED	The region or resource group is proposed after the landing zone is provisioned
PERSON_ONLY_FIELD	A field only you set, such as the data residency
ACTUATOR_OWNED_FIELD	A value the landing zone's creation writes, such as the storage account, Key Vault or provisioning time: "is written by the CALZ actuator when the person creates the landing zone, so it can never be proposed."
UNKNOWN_CALZ_FIELD	Any other field: "is not a proposable CALZ field. Allowed: Name, Description, Region, ResourceGroupName."

A pending proposal shows at the top of this window: "An agent has proposed a private landing zone for this workspace". Accept Proposal and Create "records it first, with nothing provisioned, then starts this window's own create in your Azure subscription." The window creates the landing zone in its own resource group, and says so when the proposal named another. When the landing zone is already provisioned the button is Accept Proposal, which only records the proposed name and description. With no connected cloud there is only Reject Proposal: "A landing-zone proposal can be accepted only once a cloud is connected."

Messages you may see

Code or place	Message
The form	"Region is required. Pick the Azure region this landing zone will live in."
Refused by the server	"A region is required. Pick one from the list before provisioning." or "A resource group name is required."
A run that failed	The platform's reason, or "The landing zone did not finish provisioning, and the platform did not report a reason." Read the resource rows and use Finish provisioning
Re-running	"This landing zone record is missing its region or resource group, so it cannot be re-provisioned safely."
The health check	"Azure reports these no longer exist: (the list). Re-provision to recreate them." When the check could not reach a resource, the window says so, and that this does not mean it is missing
DEPLOY_IN_PROGRESS	A setup window or a Deploy is already running for the workspace. Wait for it to finish, then try again
KIND_NOT_DELETABLE	The landing zone cannot be removed (above)

Next steps

• What unlocks now -> Environment
• Device data -> Data & IoT Fabric
• Documents -> Databases
• The record of changes -> Provenance