Azure Login
Runs az login --use-device-code. A URL + code appear in the live output - open the URL in any browser, enter the code, and pick your Work or School account. Skip if already authenticated.
Pre-flight
Captures subscription, tenant, your object ID, and egress IP, then prefills the forms.
1 · State Backend
2 · Secrets Vault
2b · Seed Secrets
Writes install secrets into the bootstrap Key Vault. Values are sent once and never stored on disk.
3 · Main Deploy
4 · Post-apply
Tick the steps to run - uncheck any you'll do manually. Only checked steps run; the rest are marked skipped. The "Open temp SQL firewall" step enables Public Network Access (Selected networks) and adds your egress IP; "Remove temp SQL firewall" reverts it to Disabled.