feat: Azure get-well [COMP-806] by justinegeffen · Pull Request #1315 · seqeralabs/docs

justinegeffen · 2026-04-16T10:23:20Z

Fixes: https://seqera.atlassian.net/browse/COMP-806.
Fixes: https://seqera.atlassian.net/browse/EDU-1058

netlify · 2026-04-16T10:23:26Z

✅ Deploy Preview for seqera-docs ready!

Name	Link
🔨 Latest commit	`261fa1c`
🔍 Latest deploy log	https://app.netlify.com/projects/seqera-docs/deploys/69e0b89ced746c000860f47c
😎 Deploy Preview	https://deploy-preview-1315--seqera-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>

Revert studios/add-studio.md to master version. The overview.md whitespace fixes are enforced by pre-commit hooks and remain as-is. Cloud changes ported to azure-getwell-cloud branch. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Restore custom-roles.md and roles.md to master versions. Cloud changes to be ported separately to azure-getwell-cloud branch. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…s/docs into justine-azure-get-well

Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>

justinegeffen · 2026-04-27T16:35:34Z

@MichaelTansiniSeqera, this is good to review.

MichaelTansiniSeqera · 2026-05-01T12:57:56Z

 #### Accounts

-Azure uses accounts for each service. For example, an [Azure Storage account][az-learn-storage] will house a collection of blob containers, file shares, queues, and tables. An Azure subscription can have multiple Azure Storage and Azure Batch accounts - however, a Platform compute environment can only use one of each. Multiple Platform compute environments can be created to use separate credentials, Azure Storage accounts, and Azure Batch accounts.
+Azure uses accounts for each service. For example, an [Azure Storage account][azure-storage-account] will house a collection of blob containers, file shares, queues, and tables. An Azure subscription can have multiple Azure Storage and Azure Batch accounts - however, a Platform compute environment can only use one of each. Multiple Platform compute environments can be created to use separate credentials, Azure Storage accounts, and Azure Batch accounts.


"At a minimum, you will require an Azure Batch account and an Azure storage account to run pipelines with Azure Batch with Seqera. This is because Azure uses accounts fo reach service"

MichaelTansiniSeqera · 2026-05-01T13:18:30Z

+10. Select **Review and Create**.
+11. Select **Create**.
+12. Go to your new Batch account, then select **Access Keys**.
+13. Store the access keys for your Azure Batch account, to be used when you create a Seqera compute environment.


only if they are using keys - do we need a section on creating Entra and Service Principal and MIs?

I think we should add here that Entra is now recommended as the credential mechanism

MichaelTansiniSeqera · 2026-05-01T13:20:13Z

+   When you use separate head and worker pools, you can assign a different managed identity to head and worker pools. Each pool receives only the managed identity relevant to its role.
+   :::
+
+4. When you set up the Seqera compute environment, select the Azure Batch pool by name and enter the managed identity **client ID** and (optionally) the **resource ID** in the specified fields. The resource ID is the full ARM path of the managed identity (e.g., `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}`).


if using Forge rather than optionally

MichaelTansiniSeqera · 2026-05-01T13:21:08Z

 When you submit a pipeline to this compute environment, Nextflow will authenticate using the managed identity associated with the Azure Batch node it runs on, rather than relying on access keys.

+:::caution
+If a managed identity is misconfigured (e.g., invalid client ID or missing RBAC roles), the pipeline will fail with an explicit error. Seqera will not silently fall back to access key authentication.


@adamrtalbot or @jonmarti correct me if I'm wrong but we fall back to the Entra Service Principal if the MI is wrong, but we DON'T do that for access keys right? If so, we should make that clear here

The fallback model is a bit subtler than "MI wrong → fall back to SP". Two layers behave differently:

Control plane (Platform → Azure Batch / Storage): whatever credential is configured (access keys or Entra service principal) is what Platform uses. The two are alternatives, not a runtime chain. Bad keys, invalid/expired client secrets, or missing RBAC all fail loudly with no silent fallback. Some features (VNet/subnet, managed identity assignment) require Entra because the underlying operation only accepts AAD tokens.

Data plane on the VM (Nextflow head + tasks → Storage / ACR):

Credential Head MI configured? How the head VM authenticates

Access keys n/a Storage account key provisioned to the VM

Entra SP No SP credentials passed into the Nextflow config ⚠ secret on the VM

Entra SP Yes Short-lived token from the Azure metadata service (no creds on the VM)

Entra SP Yes, but invalid / missing RBAC Fails — no silent fallback to the SP at runtime

So the existing caution is correct for runtime. What's worth adding is the config-time half , that's where the "fallback" really lives:

When a head managed identity is not configured, Platform passes the service principal credentials to the head job so it can authenticate to Azure services. The managed identity removes the long-lived secret from the compute node, so configuring it is recommended for production deployments. The same applies to the pool managed identity used by compute tasks.

MichaelTansiniSeqera · 2026-05-01T13:26:52Z

+16. Enable **Dispose resources** for Seqera to automatically delete the Batch pools if the compute environment is deleted on the platform.
+
+:::info
+Batch Forge creates separate Azure Batch pools for the Nextflow head job and compute tasks by default (named `tower-pool-{envId}-head` and `tower-pool-{envId}-worker`). This prevents the head node from competing for resources with compute tasks and allows independent sizing of each pool.


Add "please bear in mind when running multiple Azure Batch compute environments the Azure Batch initial limits are 100 by default, with a maximum of 500. For further context on limits see here

The default limit for us is zero! I had to argue profusely to lift it and they genuinely tried to tell me "you only need three for dev, staging, prod" 😆

😱 Maybe just warn about limits when running multiple CEs then as they'll be exhausted twice as fast?

feat: Azure get-well [COMP-806]

261fa1c

justinegeffen added do not merge Do not merge until this label is removed draft/WIP enterprise-26.1 labels Apr 16, 2026

justinegeffen changed the base branch from master to enterprise-26.1-documentation April 16, 2026 11:06

MichaelTansiniSeqera reviewed Apr 17, 2026

View reviewed changes

Comment thread platform-cloud/docs/studios/add-studio.md Outdated

MichaelTansiniSeqera reviewed Apr 17, 2026

View reviewed changes

Comment thread platform-enterprise_docs/compute-envs/azure-batch.md Outdated

justinegeffen commented Apr 17, 2026

View reviewed changes

Comment thread platform-cloud/docs/studios/add-studio.md Outdated

justinegeffen and others added 8 commits April 17, 2026 12:34

Apply suggestion from @justinegeffen

3b1b5b2

Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>

Update azure-batch.md

bb599a7

Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>

Merge branch 'enterprise-26.1-documentation' into justine-azure-get-well

a5c9c65

docs: remove remaining cloud changes from Azure get-well PR

13cc105

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs: remove cloud changes from Azure get-well PR

8859b3a

Restore custom-roles.md and roles.md to master versions. Cloud changes to be ported separately to azure-getwell-cloud branch. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Merge branch 'enterprise-26.1-documentation' into justine-azure-get-well

82227bc

Merge branch 'justine-azure-get-well' of https://github.com/seqeralab…

b264f4e

…s/docs into justine-azure-get-well

justinegeffen requested a review from MichaelTansiniSeqera April 17, 2026 17:50

justinegeffen added 4 commits April 20, 2026 13:38

Merge branch 'enterprise-26.1-documentation' into justine-azure-get-well

eab2039

Update azure-batch.md

17b4a37

Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>

Merge branch 'enterprise-26.1-documentation' into justine-azure-get-well

74a7fdb

Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>

Merge branch 'enterprise-26.1-documentation' into justine-azure-get-well

52b3c41

justinegeffen removed the draft/WIP label Apr 27, 2026

justinegeffen added 3 commits April 28, 2026 10:22

Merge branch 'enterprise-26.1-documentation' into justine-azure-get-well

991b933

Merge branch 'enterprise-26.1-documentation' into justine-azure-get-well

dd9ae2e

Merge branch 'enterprise-26.1-documentation' into justine-azure-get-well

714300d

justinegeffen requested a review from jonmarti April 30, 2026 18:33

justinegeffen added the 1. Dev/PM/SME Needs a review by a Dev/PM/SME label Apr 30, 2026

MichaelTansiniSeqera reviewed May 1, 2026

View reviewed changes

Merge branch 'enterprise-26.1-documentation' into justine-azure-get-well

1d0675b

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Azure get-well [COMP-806]#1315

feat: Azure get-well [COMP-806]#1315
justinegeffen wants to merge 17 commits intoenterprise-26.1-documentationfrom
justine-azure-get-well

justinegeffen commented Apr 16, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Apr 16, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

justinegeffen commented Apr 27, 2026

Uh oh!

MichaelTansiniSeqera May 1, 2026

Uh oh!

MichaelTansiniSeqera May 1, 2026

Uh oh!

MichaelTansiniSeqera May 1, 2026

Uh oh!

MichaelTansiniSeqera May 1, 2026

Uh oh!

MichaelTansiniSeqera May 1, 2026

Uh oh!

jonmarti May 3, 2026

Uh oh!

MichaelTansiniSeqera May 1, 2026

Uh oh!

adamrtalbot May 1, 2026

Uh oh!

MichaelTansiniSeqera May 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Credential	Head MI configured?	How the head VM authenticates
Access keys	n/a	Storage account key provisioned to the VM
Entra SP	No	SP credentials passed into the Nextflow config ⚠ secret on the VM
Entra SP	Yes	Short-lived token from the Azure metadata service (no creds on the VM)
Entra SP	Yes, but invalid / missing RBAC	Fails — no silent fallback to the SP at runtime

Conversation

justinegeffen commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for seqera-docs ready!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

justinegeffen commented Apr 27, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

justinegeffen commented Apr 16, 2026 •

edited

Loading

netlify Bot commented Apr 16, 2026 •

edited

Loading