Install on Microsoft Azure

Copy link to this section

C3 AI deployment options: guidance for enterprise customers

C3 AI offers flexible deployment models to meet the diverse needs of enterprise customers. Selecting the appropriate deployment option is a critical decision that impacts project timelines, service-level agreements (SLAs), and roles and responsibilities (RACI). This document outlines each option, highlights key considerations, and underscores the benefits of the C3 AI SaaS/PaaS Subscription, which is the recommended approach for most organizations.

Copy link to this section

1. C3 AI SaaS / PaaS subscription (preferred standard option)

The standard C3 AI SaaS/PaaS (Software as a Service / Platform as a Service) subscription is the most typical deployment option to leverage the C3 AI Platform and Applications. It is a fully hosted and managed service by C3 AI in Microsoft Azure. Customers may select their preferred Azure region for data residency.

Key Features and Benefits:

• Lower Total Cost of Ownership (TCO): Standardized technologies and processes enable rapid deployment, streamlined support, and efficient issue resolution. C3 AI maintains specific enterprise SLAs to deliver an industry-leading service with lower TCO.
• Reduced Operational Burden: Internal teams can focus on leveraging AI applications for business value, rather than managing infrastructure setup and maintenance.
• Scalability: The SaaS/PaaS model supports seamless scaling as business needs evolve. C3 AI manages all scaling needs and capacity planning required to ensure consistently available platform and applications.
• Security and Compliance: C3 AI employs industry standard cybersecurity and access control practices to safeguard customer applications and data. C3 AI holds and maintains critical compliance attestations like SOC2, ISO27001, and FedRAMP.

Why Choose SaaS/PaaS?

This model is the fastest, most cost-effective way to realize value from C3 AI products and generate AI-driven insights. It is recommended for organizations seeking minimal operational overhead and maximum agility.

Copy link to this section

2. Customer-hosted, C3 AI-managed deployment

For organizations with non-standard data residency, security, or governance requirements, C3 AI supports deployments within a customer's own Azure Virtual Network (VNet). C3 AI Operations manages the deployment, maintenance, and support within the customer's environment. Your organization will have responsibility for portions of the infrastructure to ensure C3 AI Operations can successfully deploy and manage C3 AI Products. Coordination with C3 AI Operations will be required for future upgrades, change and incident management activities. Additional charges may apply to support a customer-hosted deployment.

Key Considerations:

• Customer Responsibilities:
  • Grant C3 Operations owner access to a dedicated Azure subscription for C3-managed deployments, or alternatively, provision a secure Azure VNet using C3 AI's Terraform module with access granted to C3 Operations as described below. Provide timely and required access to C3 AI Operations for installation and ongoing support.
  • Manage and troubleshoot infrastructure changes outside C3 AI's control that may affect availability or performance.
  • Assume all infrastructure hosting costs within the customer's cloud account.
• Control and Access: Customers retain greater control and thus greater responsibility over their Azure subscription and can limit permissions granted to C3 AI.

When to Choose This Option:

This model is suitable for organizations with:

• Internal processes requiring direct control over cloud resources.
• Policies with non-standard local data residency, security, or governance requirements.

Copy link to this section

Summary table

Selecting the right deployment option is essential for project success. C3 AI strongly recommends the SaaS/PaaS Subscription for most enterprises, as it maximizes value, reduces risk, and accelerates time to insight.

If you have questions or require a tailored recommendation (for example, customer-managed VNet provisioning), please reach out to your C3 AI representative.

Copy link to this section

Customer-hosted install requirements: checklist

Copy link to this section

Summary

For C3 AI to operate in a customer-hosted Azure Cloud account, your organization must meet the following requirements consistently throughout the contract term. Deviations from the installation requirements incur additional operational fees.

You agree that your organization will allow C3 AI Operations to deploy all infrastructure required to support the C3 AI applications and platform per this specification and utilizes C3 AI deployment automation. This checklist only applies to customer-hosted installations.

Copy link to this section

Installation and operational management checklist

For C3 AI Operations to deploy a cluster in a customer-hosted deployment, you must provide the following access, network setup, and infrastructure to C3 AI:

1. An infrastructure creation role ({cluster_name}-c3icrole-01) with temporary administrator privileges to a dedicated Azure subscription so that C3 AI can perform tasks to set up your deployment.

   C3 AI requires administrator privileges to set up IAM policies, custom roles, and managed identities that allow C3 AI Operations to perform installation, setup, and deployment tasks. The Terraform bootstrap module creates this role automatically. You can remove administrator access after initial setup. You must grant administrator access again for new product releases and for any subsequent infrastructure changes, because the administrator role is required to read current infrastructure state.

2. Three managed identities for ongoing infrastructure management:

   Managed Identity	Purpose
   {cluster_name}-c3-mi-01	C3 AI application workloads
   {cluster_name}-c3privileged-mi-01	Privileged C3 AI application workloads
   {cluster_name}-kube-mi-01	Kubernetes and kubelet operations

   These managed identities are created by the Terraform bootstrap module with the required Azure role assignments. See Appendix B: Terraform Module Reference for the full list of role assignments.

3. If your firewall settings prevent C3 AI Operations from configuring access to required endpoints, you must allow access to the following:

   • Routing to and from the C3 AI network so C3 AI can receive metrics, logs, and observability data to operate the deployment.
   • Connectivity to endpoints that allow C3 AI product functionality.

4. New VNet and subnets with at least 1024 IP addresses (/22) available for C3 deployment. The Terraform module creates the VNet and all required subnets automatically. AKS node pools are deployed across three availability zones by default.

5. Static DNS entry for C3 AI URL (for example, c3project.customer.com).

6. Public certificate with the complete chain and private key. Certificates issued by a public or an internal Certificate Authority are supported. Coordinate with the C3 AI Center of Excellence if you plan to use self-signed or internal-CA certificates so that the required trust chain can be pre-staged in the cluster.

Copy link to this section

C3 AI installation requirements for Azure

The C3 Agentic AI Platform integrates with core Azure services like Azure VM, Azure Virtual Network (VNet), and IAM, enabling cohesive security and infrastructure management.

The C3 Agentic AI Platform requires specific Microsoft Azure cloud services and infrastructure for successful deployment, as well as specific access requirements for C3 AI Operations to install, administer, and upgrade the C3 Agentic AI Platform and C3 AI Applications.

Install and upgrade requirements including Bill of Materials (BOM) details can be reviewed on the documentation site: https://docs.c3.ai/versions-and-compatibility/upgrade-requirements/8.11.

The following sections describe the specific services and access needs, including network configurations and subnet requirements, security group egress and ingress rules, and subnet-level access control lists (ACLs).

Copy link to this section

Required Microsoft Azure cloud services

The table below describes the Microsoft Azure cloud infrastructure services required by the C3 Agentic AI Platform. You are required to provide access to the services below configured to C3 AI specifications as documented in the HashiCorp Terraform scripts.

Copy link to this section

Microsoft Azure cloud access requirements

The table below describes the access requirements for C3 AI Operations to install, administer, and upgrade the C3 AI Applications and C3 Agentic AI Platform.

To ensure security, operational excellence, and customer trust, C3 AI leverages an industry standard privileged access management (PAM) for infrastructure access and authentication. All access by our C3 AI Operations team to customer hosted deployments will be managed exclusively through this PAM solution. This approach ensures every interaction with the systems is secure, fully auditable, and aligned with industry best practices.

Why PAM and what this means for you:

• Centralized Access Control: All infrastructure access is managed through a single, secure platform, reducing complexity and risk.
• Enhanced Security: PAM enforces strong authentication and zero-trust principles, ensuring only authorized personnel can access your systems.
• Full Auditability: Every session and command is logged, providing complete visibility for compliance and security reviews.
• Rapid Access Revocation: Access can be granted or revoked instantly, minimizing exposure during personnel changes or incident response.
• Operational Efficiency: Our Operations team benefits from streamlined workflows, reducing time to resolution for support and maintenance tasks.
• Industry Best Practices: PAM aligns with leading security frameworks and compliance standards, reinforcing trust and reliability.

Requirements of the PAM solution:

• One time use of Azure service principal role to deploy the cluster and for select infrastructure upgrades
• Service account created in your SSO / Active Directory used to manage the C3 AI Platform
• Azure Lighthouse role assignments for designated C3 AI Operations personnel
• An additional /28 CIDR IP block for the C3 Software-Defined Perimeter/Management (SDM) peered VNet

C3 AI Operations will deploy and install the PAM solution. You can request an audit log of user access by contacting C3 AI Customer Support.

Copy link to this section

Azure subscription

The Azure subscription must have the following Azure resource providers registered before deployment:

• az provider register --namespace Microsoft.Compute
• az provider register --namespace Microsoft.DBforPostgreSQL
• az provider register --namespace Microsoft.Network
• az provider register --namespace Microsoft.ManagedIdentity
• az provider register --namespace Microsoft.KeyVault
• az provider register --namespace Microsoft.Storage
• az provider register --namespace Microsoft.ContainerService
• az provider register --namespace Microsoft.Quota

Copy link to this section

Network configuration

To deploy the C3 Agentic AI Platform in your own Azure Virtual Network (VNet), C3 AI will create the VNet following the steps enumerated in the VNet requirements section below.

Copy link to this section

VNet requirements

The VNet must meet the following requirements to host a C3 AI cluster.

• Azure subscription
• VNet region
• VNet sizing
• VNet IP address ranges
• DNS
• Subnets
• Security groups
• Subnet-level network ACLs

The Azure subscription containing the C3 Agentic AI Platform must have end-to-end encryption enabled using encryption at host. Data stored on the host is encrypted at rest and flows encrypted to the Azure Storage service. Encryption at host must be enabled and can be accomplished using the Azure Portal or CLI. To enable encryption at host using the Azure CLI, run the following:

az feature register --name EncryptionAtHost --namespace Microsoft.Compute

The Terraform module enforces encryption at host for all AKS node pools (host_encryption_enabled = true by default).

Copy link to this section

VNet region

The Azure region where deployment will occur. Refer to Azure documentation for a list of available regions.

Copy link to this section

VNet sizing

Provision a separate VNet per cluster. Sharing a single VNet across multiple clusters in the same Azure subscription is not supported. Size your VNet and subnets to C3 AI specifications.

Copy link to this section

VNet IP address ranges

C3 AI does not impose strict limits on VNet netmasks. These are our recommendations.

For AKS deployment, C3 AI sets up two non-overlapping network address spaces with distinct purposes:

Primary VNet -- By default, the primary virtual network uses a /22 (we typically use 10.0.0.0/22, but any equivalent /22 range works).

Kubernetes pod and service networks -- In addition to the primary VNet, AKS requires separate private CIDR ranges that should not overlap with the primary VNet. The Terraform defaults are:

These secondary CIDR ranges are internal to Kubernetes and are not subnets carved out of the primary /22 VNet.

Copy link to this section

DNS

The VNet will have DNS hostnames and DNS resolution enabled.

Copy link to this section

Subnets

The Terraform module creates the following subnets within the VNet for each cluster:

Copy link to this section

Subnet route table

The route table ({cluster_name}-rt-01) for workspace subnets must have quad-zero (0.0.0.0/0) traffic that targets the appropriate network device.

Copy link to this section

Additional subnet requirements

• Subnets must have outbound access to the public network using a cloud native NAT gateway ({cluster_name}-natgw-01) and internet gateway.
• The NAT gateway is automatically created and associated with the AKS, Data, Tool, Storage Account, and Key Vault subnets.

Copy link to this section

Security groups

The Terraform module creates the following Network Security Groups (NSGs):

NSG rules are configurable via Terraform variables (dmz_nsg_rules, aks_nsg_rules, data_nsg_rules, tool_nsg_rules, sa_nsg_rules, kv_nsg_rules, aksapi_nsg_rules). Default rules are applied at deployment time. Contact the C3 AI CoE for the required rule configuration for your deployment.

Security groups must include the rules described in the following subsections: Endpoint access, Egress (outbound), Ingress (inbound), and Subnet-level network ACLs.

Copy link to this section

Endpoint access

If your firewall settings prevent C3 AI Operations from configuring endpoint access, you must allow outbound access to the following endpoints to allow C3 AI product functionality. These endpoints provide access to container registries, language-runtime package repositories (Python, NodeJS, Anaconda), C3 AI artifact servers, and the vault that secures platform credentials. Blocking any of them prevents platform installation, upgrades, or runtime operations. Contact the C3 AI Center of Excellence for a per-endpoint justification if required for security review.

• conda.anaconda.org - Package repository for Conda environments and dependencies
• files.pythonhosted.org - File hosting service for Python packages distributed via PyPI
• github.com - Source code hosting and version control platform
• c3ai.grafana.net - C3 AI's Grafana-hosted monitoring and observability dashboards
• huggingface.co - Repository for pre-trained machine learning models and datasets
• jfrog.c3.ai - C3 AI's internal JFrog Artifactory instance for artifact and package management
• nodejs.org - Official Node.js runtime downloads and documentation
• npmjs.org - Package registry for Node.js/JavaScript dependencies
• prdgkemis.c3.ai - C3 AI endpoint for MIS (Management Information System) access (if required)
• pypi.org - Primary Python package index for installing Python libraries
• pypi.python.org - Legacy Python package index mirror, an alias for PyPI
• registry.c3.ai - C3 AI's private container and artifact registry
• repo.anaconda.com - Anaconda's repository for curated data science packages
• repo.continuum.io - Legacy Continuum Analytics (now Anaconda) package repository
• telemetry.c3.ai - C3 AI endpoint for collecting platform telemetry and usage data
• vault.c3iot.io - C3 AI's HashiCorp Vault instance for secrets and credentials management

You must allow outbound access to the following endpoints for C3 AI Monitoring. These IP addresses collect standard operational metrics:

• fleet-management-prod-014.grafana.net
• prometheus-prod-36-prod-us-west-0.grafana.net
• logs-prod-021.grafana.net

You must allow inbound access to the following C3 AI Operations endpoints to operate the deployment:

• 12.226.154.130/32
• 13.214.249.29/32
• 18.136.19.189/32
• 34.231.113.223/32
• 34.232.23.54/32
• 34.238.215.224/32
• 34.82.144.175/32
• 52.48.79.190/32
• 54.76.64.220/32
• 70.35.33.244/32

Copy link to this section

Egress (outbound)

• Allow all TCP and UDP access to the workspace security group (for internal traffic)
• Allow TCP access to 0.0.0.0/0 for these ports:
  • 443: for C3 AI infrastructure, cloud data sources, and library repositories

Copy link to this section

Ingress (inbound)

• Allow all TCP and UDP access to the workspace security group (for internal traffic)
• 443: for C3 AI application access
• 22: for SSH access to a bastion host

Copy link to this section

Subnet-level network ACLs

Subnet-level network ACLs must not deny ingress or egress to any traffic.

• ALLOW ALL from Source 0.0.0.0/0. This rule must be prioritized.
• Egress:
  • Allow all traffic to the C3 AI cluster VNet CIDR, for internal traffic.
  • Allow TCP access to 0.0.0.0/0 for these ports:
    • 443: for C3 AI infrastructure, cloud data sources, and library repositories.

Copy link to this section

HashiCorp Terraform configuration

HashiCorp Terraform is a popular open-source tool for creating safe and predictable cloud infrastructure across several cloud providers. Terraform scripts are used to create the cloud infrastructure required by the C3 Agentic AI Platform and automate the deployment of the C3 Agentic AI Platform in your Azure subscription.

Copy link to this section

Getting started

In this section, you install and configure requirements to use Terraform. You then configure Terraform authentication. Following completion of this section, you go to the "Installation Steps" section below to deploy and configure the cloud infrastructure required by the C3 Agentic AI Platform.

Copy link to this section

Requirements

To use Terraform to create cloud infrastructure resources required by the C3 Agentic AI Platform in your Azure account, you must have the following:

• An Azure subscription. Terraform provisions the resource group; you do not need to create one in advance.
• A user with the Owner role on the Azure subscription. This role is required for initial deployment.
• On your local development machine, you must have:
  • The HashiCorp Terraform CLI (>= 1.13.0). See Install Terraform on the Terraform website. Select AMD64 or ARM64 to match the client hardware from which you will run the Terraform scripts.
  • The Azure CLI, signed in through the az login command with a user that has Owner rights to your subscription to access Microsoft Azure Cloud. See How to install the Azure CLI and Sign in with Azure CLI for more information.
  • The Kubernetes CLI (kubectl). See the Kubernetes website for more information about kubectl and related commands for infrastructure creation and deployment.
  • The Helm CLI. See Installing Helm on the Helm website for more information.
• Privileges to deploy, operate, and delete the infrastructure services. See the README.md file in the downloaded Registry folder for the most up-to-date information.

Copy link to this section

Installation steps

Installation of the C3 Agentic AI Platform on Microsoft Azure is a multi-step process due to limitations of HashiCorp Terraform and Azure-specific configuration requirements. The installation process is the following:

1. Create the Microsoft Azure Virtual Network (VNet) and required Azure services.
2. Validate the configuration of the VNet and required Azure services and provide C3 AI Operations access to the cluster.

To create a VNet, C3 AI requires the use of HashiCorp Terraform and will provide a set of Terraform scripts to assist you in the creation of the VNet and required Azure services.

In addition to the required tools listed in the "HashiCorp Terraform Requirements" section, install TFSwitch, which is a tool used to switch easily between Terraform versions. See Install TFSwitch and TFSwitch Quick Start on the TFSwitch website for more information.

Copy link to this section

1. Create the VNet and required Azure services

This guide shows you how to create the cloud infrastructure services required by the C3 Agentic AI Platform using HashiCorp Terraform on Azure.

Copy link to this section

1.1 Run the bootstrap module

This module creates the necessary IAM roles, custom roles, managed identities, and policies to configure the VNet and required Azure services. Configure a new main.tf file below, replacing the CAPITALIZED variable names with your values.

Cluster Naming Rules:

The cluster name must adhere to the following restrictions:

• Must start with a lowercase letter
• Only lowercase letters and numbers are allowed (no hyphens, special characters, or diacritics)
• Must be at most 15 characters total
• For Dev and QA clusters: <stg><cloud><customerabbreviation> where <cloud> is az. For example, stgazcust
• For Production clusters: <prd><cloud><customerabbreviation> where <cloud> is az. For example, prdazcust

module "bootstrap" {
  source                  = "<c3_url>/tf-registry__c3/azure/c3//modules/bootstrap"
  version                 = "VERSION_NUMBER"
  cluster_name            = "CLUSTER_NAME"
  region                  = "REGION"
  setup_role_principal_id = "IDENTITY_OBJECT_ID"
}

provider "azurerm" {
  features {}
  partner_id      = "AZURE_PARTNER_ID"
  tenant_id       = "AZURE_TENANT_ID"
  subscription_id = "AZURE_SUBSCRIPTION_ID"
}

terraform {
  required_version = ">= 1.13.0"
}

Replace the following:

What the bootstrap module creates:

Copy link to this section

1.2 Run Terraform commands

After configuring the main.tf file, run the following Terraform commands from the same directory:

tfswitch
terraform init
terraform plan --out out.plan
terraform apply "out.plan"

Copy link to this section

1.3 Run the c3cluster module

This module coordinates execution of all other Terraform modules.

Configure a new main.tf in a separate directory from the bootstrap module, replacing the CAPITALIZED variable names with your values.

Be sure to login as the service principal that you specified as setup_role_principal_id in the bootstrap module.

Contact your account manager for C3 Control IPs (the list of IP addresses required by C3 AI). These IP addresses enable access for C3 AI Services to manage and maintain the C3 AI cluster. Replace the CIDR_TO_WHITELIST parameter below with the list of IP addresses.

module "c3cluster" {
  source       = "<c3_url>/tf-registry__c3/azure/c3"
  version      = "VERSION_NUMBER"
  c3_region    = "REGION"
  cluster_name = "CLUSTER_NAME"

  ip_allowlist = [
    "CIDR_TO_WHITELIST",
  ]

  storage_cors_domains = ["http://*.DOMAIN_NAME"]
  # "Default" is only for first-time provisioning. Subsequent terraform apply
  ## runs must use "Update"
  pg_create_mode = "Default"
}

provider "azurerm" {
  features {}
  partner_id      = "AZURE_PARTNER_ID"
  tenant_id       = "AZURE_TENANT_ID"
  subscription_id = "AZURE_SUBSCRIPTION_ID"
}

terraform {
  required_version = ">= 1.13.0"
}

Replace the following:

Copy link to this section

1.3.1 Implement CORS policy for C3 AI Ex Machina

If the installation of the C3 Agentic AI Platform includes C3 AI Ex Machina, setting the C3 AI CORS domain via storage_cors_domains is all that is necessary. The CORS policy facilitates file uploads for C3 AI Ex Machina.

See storage_cors_domains in the main.tf example above. Also see the cors_rules.tf template example in the Terraform modules for more configuration details.

After configuring the main.tf file, run the following from the same directory as the new main.tf file:

tfswitch
terraform init
terraform plan --out out.plan
terraform apply "out.plan"

Copy link to this section

2. Validate and provide access to the cluster

Step summary: Validate the configuration of the VNet and required Azure services and provide C3 AI Operations access to the cluster.

After the VNet and required cloud services are configured, you are required to execute the C3 AI Cluster Validation Utility and provide the results to C3 AI. If all checks performed by the C3 AI Cluster Validation Utility pass, the VNet is suitable for C3 AI Operations to deploy the C3 Agentic AI Platform on the Kubernetes cluster.

Once the checks are successfully completed, provide C3 AI Operations access to the cluster. Refer to the subsequent section for more information.

Copy link to this section

2.1 Run the C3 AI Cluster Validation Utility and provide results to C3 AI Operations

Contact the C3 AI CoE for more information and to obtain the C3 AI Cluster Validation Utility.

Run the C3 AI Cluster Validation Utility to determine whether the infrastructure requirements are fulfilled to allow C3 AI Operations to deploy the C3 Agentic AI Platform.

If the C3 AI Cluster Validation Utility indicates the VNet is ready for C3 AI Operations to deploy the C3 Agentic AI Platform on the Kubernetes cluster, provide the output to C3 AI Operations.

If the output indicates the VNet is not ready, remediate all exceptions and rerun the C3 AI Cluster Validation Utility.

Copy link to this section

2.2 Provide C3 AI Operations access to the cluster

In addition to the output of the C3 AI Cluster Validation Utility, you must provide C3 AI Operations with the following.

It is strongly recommended that the sharing of Postgres credentials and certificates occur using Azure Key Vault.

To grant C3 AI Operations AKS cluster administration permissions in the subscription, create a new role assignment for C3 AI Operations users, granting them the Azure Kubernetes Service Cluster Admin role:

az login
az role assignment create \
--assignee <OBJECT_ID_OF_THE_USER> \
--role "Azure Kubernetes Service Cluster Admin Role" \
--scope /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<C3_CLUSTER_RESOURCE_GROUP>

Replace the following:

Copy link to this section

Appendix A: Default resource naming convention

All resources follow the pattern {cluster_name}-{component}-{sequence}. Default names can be overridden via Terraform input variables.

Copy link to this section

Appendix B: Terraform module reference

The following Terraform modules are used to deploy the C3 Agentic AI Platform infrastructure. See the README.md file in each module directory for detailed input/output documentation.