5. Handoff to IT
Owner: Cloud Ops → IT · Time: ~15 min
You’ll finish with: a completed handoff table IT can work from directly.
The backend is healthy and reachable from a managed-device network. The handoff is identical on AWS, Google Cloud, and Azure.
Confirm the Entra inputs you deployed
Section titled “Confirm the Entra inputs you deployed”IT already gave you:
- Your Entra tenant ID.
- The Arbium Agent (Roots) client ID.
- The Entra login host (
login.microsoftonline.com, or the approved sovereign cloud host).
If the fleet console is enabled, IT also gave you the Arbium Admin application
values, admin-group object IDs, and SCIM groups. Do not proceed if any are
missing or don’t match the rendered chaindb-config ConfigMap.
The handoff table
Section titled “The handoff table”Copy this table, fill in the last column, and send it to IT. It is the single artifact that crosses between the two teams — don’t send values in fragments over chat.
| Value | Where you find it | Where IT enters it | Fill in |
|---|---|---|---|
| Arbium server address | https://arbium.<your-domain> — the origin in global.publicBaseUrl |
Windows: the Intune install command (walkthrough, Create the Intune app) | |
| Upload endpoint (macOS only) | https://arbium.<your-domain>/functions/v1/captures-batch-direct |
macOS managed-preferences profile. Windows needs only the server address. | |
| Publishable key (macOS only) | config.edgeFnsAnonKey in the shared values file |
macOS managed-preferences profile, next to the endpoint | |
| Fleet console URL (if enabled) | https://arbium.<your-domain>/admin |
Bookmark for admins; smoke test (walkthrough, Smoke test one device) | |
| SCIM Tenant URL (if enabled) | https://arbium.<your-domain>/scim/v2 |
Entra provisioning settings on the Arbium SCIM app | |
| SCIM bearer token (if enabled) | Cloud secret store | Same Entra provisioning settings — send via the approved secret channel only | |
| Support context | — | Cloud provider, region, environment name, support contact |
Verify the endpoint one final time before sending:
curl -fsS https://arbium.<your-domain>/functions/v1/healthcurl -fsS https://arbium.<your-domain>/functions/v1/auth-configValues that never leave Cloud Ops
Section titled “Values that never leave Cloud Ops”Never send these to managed devices or put them in a device policy:
- Database URL or database credentials.
- Scheduler, enrollment, JWT, SCIM, or Admin client secrets — except the SCIM token, sent directly to the Entra provisioning administrator.
- GHCR token or cloud workload-identity credentials.
- Cloud secret-store values, Terraform state, or Kubernetes Service URLs.
- Cluster endpoints, controller credentials, or certificate private keys.
The scheduler token authenticates only in-cluster CronJob calls; the GHCR token pulls release artifacts. Neither is an agent credential.
What IT does next
Section titled “What IT does next”IT continues in the setup walkthrough, which runs the same two checks above from the browser and then fills the Intune app’s settings with your handoff values.
After the smoke test passes, record the deployment as live: cloud provider, region, Terraform tag, chart version, hostname, and support owner.