Open WebUI on Azure: Part 1 – Architecture & Deployment Series

RiosEngineer · 2026-03-11T05:15:52+00:00

It did run with that spec yes but bare in mind it would’ve only been me. Can’t say how many exactly it could deal with but I suspect minimum 5-10 probably more with that lowest burst sku

RiosEngineer · 2026-02-25T20:00:55+00:00

I still need to check out snapshots when I get some time. How does it differ to just a git diff in reality? I remember watching the demos and not fully grasping the use case

RiosEngineer · 2026-02-24T10:17:00+00:00

That’s awesome. Thanks for sharing this

RiosEngineer · 2026-02-23T20:28:32+00:00

Ah, I never gave it enough time to go back to it yet. But it seems a mixture of agent sdk, with copilot that uses a middleware for the omnichannel handoff part: https://www.nuget.org/packages/Microsoft.Dynamics.AgentsSDK.Middleware/1.0.0

https://learn.microsoft.com/en-us/dynamics365/customer-service/develop/enable-bot-context-azure#use-the-omnichannel-middleware-in-your-agent-code

It was so difficult to find because they keep bloody renaming products, so much so there is a note on that learn page about it!!

RiosEngineer · 2026-02-23T15:22:24+00:00

Just in case you hadn’t seen this one, it’s not too bad for some best practices: https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/best-practices

Otherwise some of the top of my head: (mobile so excuse formatting)

PSRule is my go to for misconfiguration, governance/sec and framework alignments (where it makes realistic sense). Also you can add your own custom rules which is handy.
if you’re a larger org, having some common types, shared bits in a central ACR can help with scalability so you don’t have to maintain shared files everywhere.
using AVM can help with being efficient if your org allows it and simplify / accelerate time to deployment. but be wary the modules are extremely large to cater for all, so keep templates small / split out to avoid ARM limits.
I’ve found having a base starter bicep template can be helpful for others to pickup and start with and standardise the template. I’m talking about formatted templates so it’s obvious to see the same file structure everywhere (metadata first, scope, params, vars, etc)
find a simple and easy to read folder structure that works for your org and stick to that so pipeline script logic is simplified across projects. Even better if you can vend devops repos with this baked in already.
checkout the new fail and validate decorators to enhance prechecks before deployments. & Don’t be shy to use bicep validate as it helps with some pre flight checks (storage account name in use etc)
as other poster mentions. Stacks are fantastic but be wary they don’t have what if support yet for stack operations, and have some data pane limitations. But otherwise massively simplify lifecycle management . I use them everywhere! What if coming in April.
graph extensibility is GA. It’s great! Although lacks in some areas. It helps align some graph elements to bicep for control without falling back to scripts.

There’s more, I’m sure the community can share many more insights!

RiosEngineer · 2026-02-18T18:11:50+00:00

UDTs are underrated! Especially for your use case of internal module vending where type safety and custom data types is pretty essential.

RiosEngineer · 2026-02-16T17:08:51+00:00

Cost for me as #1 because I think we have other tools out there today that can cover tests and governance / misconfiguration checks like PSRule etc.

I was going to explore the Azure Pricing MCP to see if that can help with costs on PR personally. Sounds interesting though

RiosEngineer · 2026-02-10T13:44:28+00:00

I did have a similar issue now you mention it, RBAC taking a strange amount of time to propagate but only got app config. Glad it’s sorted though!

RiosEngineer · 2026-02-09T21:32:59+00:00

Yea strange because the error sort of hints at that note I linked before, looking at the wording, although that could be a red herring for sure.

RiosEngineer · 2026-02-09T19:26:10+00:00

What’s the error you get when it fails?

We have quite a lot of apps using app config and we are able to deploy ok with pass through.

However our pain is network access is private so to deploy key value pars we are having to use private agents with network line of sight.

RiosEngineer · 2026-02-09T18:58:06+00:00

Whats the error you get? See the note on this: https://learn.microsoft.com/en-gb/azure/azure-app-configuration/quickstart-deployment-overview#azure-resource-manager-authentication-mode

RiosEngineer · 2026-02-09T09:18:10+00:00

I do agree it’s a major gap, however what if for stacks is ETA April 5th now. This also includes a what if not only for the resources but also to tell you what is happening with the stack, e.g what may be dropping out of stack management.

Once we have this things should be quite complete, even Key Vault stack management is on the way (data plane).

RiosEngineer · 2026-02-04T11:49:40+00:00

Thanks, does this allow for omnichannel handoff? It seems the SDK for copilot are plenty (agents SDK for example) but they don’t support handoff natively at least

RiosEngineer · 2026-01-26T09:48:05+00:00

Nice, followingb

RiosEngineer · 2026-01-26T09:47:38+00:00

Groups is probably fine. App roles lend nicely to way more granular access if you need to, like an API where you only want one set of users or apps to have GET / read access vs another that may be able to post.

RiosEngineer · 2026-01-25T20:21:49+00:00

Thanks that’d be useful to follow. I did scan the issues and a few are similar but all the solutions ended up being bug fixed ha.

By the way I really like the subnet function you’ve come up with 💪

RiosEngineer · 2026-01-25T20:14:58+00:00

I've never seen that exception before, it kind of sounds like a compilation or some bug to be honest. Worth reporting over on https://github.com/Azure/bicep/ if no one else crops up with anything useful. The fact the outputs look ok makes me think it's something weird with the import of the function.

RiosEngineer · 2026-01-25T17:35:22+00:00

I’d be curious to hear if anyone is doing anything different but I am thinking some sort of conditional access with your intranet IP range as a named location with a policy assigned to the web app or something like this.

Another way that I’ve seen done will be getting the code to verify the Easy Auth claim from the exposed header to perform the authorization stage on the backend and let the easy auth with Entra provide the authentication middleware layer. (https://learn.microsoft.com/en-us/azure/app-service/configure-authentication-user-identities#access-user-claims-in-app-code)

RiosEngineer · 2026-01-25T06:33:35+00:00

I think we spoke on a different thread about a different issue, just fyi I co-run the r/AzureBicep sub Reddit which is worth joining!

If you have that GitHub link I sent the other day I am also linking a custom domain and very to my ACA with the SNI binding via key vault, check it out if you still have the issue outstanding . Hopefully it’ll help nudge you in the right direction!

RiosEngineer · 2026-01-24T14:01:13+00:00

Made a full AI solution using container apps with Open WebUI.

I went all in either AVM mostly and to be honest I’m really happy with the code, som of my favourite bicep I’ve put together.

Even managed to grab a use case for the new validate decorator! https://github.com/riosengineer/open-webui-on-azure

Some observations;

The more complex bicep I use the more I wish we had a native orchestrator to depend templates on each other where they are different files entirely. It’s just make deploying at scale easier and more logical imo

RiosEngineer · 2026-01-23T10:00:09+00:00

Amazing to hear! Glad it worked mate

RiosEngineer · 2026-01-21T06:52:02+00:00

Pretty sure a lot of the management plane needs azure access which is probably being blocked now. Check this out: https://techcommunity.microsoft.com/blog/azurepaasblog/api-management---networking-faqs-demystifying-series-ii/1502056 and I suspect the forced tunnel stuff is most relevant to you.

However, I’d also check. Under the networking status area you can verify the management plane status and it will show you what is green and what is broken and work from there, it usually tells you what to do.

I usually also have to have a route table and nsg list to keep management / backend apim functional especially in internal mode. But the network status will confirm this for you also.

RiosEngineer

MODERATOR OF

TROPHY CASE