Deploy Microclaw to your Azure subscription

Self-Hosted plan setup — about 25 minutes, mostly waiting

Microclaw Self-Hosted runs entirely inside your own Microsoft Azure subscription. You purchase the software license through Microsoft Marketplace, then run the installer below from Azure Cloud Shell. The installer creates the Entra app registration, provisions the Microclaw infrastructure, and publishes the Teams app to your tenant — one command, no manual portal clicks.

If you want a fully managed version where we host the infrastructure, choose the Standard plan on Microsoft Marketplace instead.

Before you begin

You need three things:

Global Administrator rights on your Microsoft 365 tenant (so the installer can create an app registration and grant tenant-wide consent).
Owner rights on the Azure subscription you want to deploy into.
An Azure OpenAI resource with deployments named exactly gpt-4o, gpt-4o-mini, and text-embedding-3-small. Create one here if you don't have one already (takes ~5 min and access is open as of 2026 for most regions).

Cost note. Self-Hosted bills you in two places: Microsoft charges your Microsoft Marketplace subscription monthly for the Microclaw software license, and Azure charges your Azure subscription directly for compute + Azure OpenAI usage. Typical small-team Azure cost is $30-60/month.

One-click install

Open https://shell.azure.com in your browser. Sign in with your Global Administrator account. If prompted to choose Bash or PowerShell, pick Bash.
Paste this command into Cloud Shell and press Enter:

$bash <(curl -sL https://microclaw.app/setup.sh)

The installer will ask you to confirm the subscription, region, and Azure OpenAI resource, then do everything else:

Create one Entra app registration with the 22 delegated Microsoft Graph permissions Microclaw needs, plus tenant-wide admin consent.
Generate a client secret (stored in Azure Key Vault, not on disk).
Deploy the full Microclaw stack via Bicep — Container App, Bot Service, Azure Database for PostgreSQL Flexible Server, Key Vault, Container Registry, Storage. This step takes ~20 minutes (Postgres provisioning + bot image import are the slow steps).
Register the bot's OAuth callback URL on the Entra app so user sign-in completes without any manual portal step.
Bake your bot's app ID and hostname into the Teams app manifest and publish the app tenant-wide to your Teams app catalog.

Total runtime is about 25 minutes. The Cloud Shell session keeps the script alive even if you close the tab — but it's safer to leave it open until you see Microclaw is deployed.

After the installer finishes

Open Microsoft Teams (any account in your tenant).
Click Apps (bottom-left rail) and search for Microclaw. It may take 1-2 minutes to appear after tenant-wide publish.
Click Add, open Microclaw, and send hi.
Microclaw will prompt you to sign in with your Microsoft 365 account. Complete the consent, return to Teams, and you're live.

Inspecting the script first

If you'd rather read the installer before running it (recommended), open https://microclaw.app/setup.sh in your browser. It's plain bash, ~300 lines, and every step prints what it's about to do before doing it. You can also download it and run locally with the same command:

$curl -sL https://microclaw.app/setup.sh -o setup.sh && bash setup.sh

Updating to a new release

When a new Microclaw version ships, re-run the installer from Cloud Shell. It detects the existing app registration and resource group, reuses them, and just redeploys the container with the new image. Your data persists across updates.

Troubleshooting

"You must be a Global Administrator to grant tenant-wide consent." The signed-in Cloud Shell account isn't a Global Administrator. Switch accounts (Cloud Shell top-right) or have a Global Admin run the installer.

"The subscription is not registered to use namespace Microsoft.App." Container Apps isn't enabled on this Azure subscription. Run az provider register --namespace Microsoft.App in Cloud Shell and re-run the installer.

The Bicep deploy fails on image import. The ACR import step has a known timing issue if it runs before role-assignment propagation finishes. Re-run the installer — the second attempt picks up where the first stopped.

Microclaw doesn't appear in Teams after the installer finishes. Tenant-wide app catalog publishing can take 1-2 minutes to propagate. If it's been longer than 5 minutes, open the Teams Admin Center → Manage apps → search for Microclaw, and verify the status is "Allowed."

Support

Self-Hosted setup issues: email support@microclaw.app with your Azure subscription ID and the step where you got stuck. Include the Cloud Shell output if possible.

Billing: manage through Microsoft Marketplace. Azure infrastructure costs are billed separately by Microsoft Azure.

Advanced: Deploy-to-Azure button (manual identity setup)

If you prefer to create the Entra app registration and Azure Bot resource yourself and use Azure Portal's standard Custom Deployment form, you can use the legacy Deploy-to-Azure button. This path requires ~30 additional minutes of manual portal clicks (creating the app reg, adding 22 permissions one at a time, granting consent, creating the Bot Service, generating a secret). The Cloud Shell installer above is the recommended path for most customers.

Deploy Microclaw to Azure (manual)

If you click this button, you'll need to provide graphTenantId, graphClientId, teamsAppId, teamsAppPassword, and the Azure OpenAI endpoint + key. This manual path is for advanced users; if you'd like the step-by-step, contact us at support@microclaw.app and we'll walk you through it.