Skip to main content

​
Overview

This guide explains how to prepare an Azure subscription for PlanetScale Managed and deploy the one-time authorization bootstrap.
This guide is intended for PlanetScale Managed customers currently working with the PlanetScale team. You cannot complete provisioning without PlanetScale enabling Managed for your organization. If you are interested in PlanetScale Managed, contact us.

​
Step 1: Prepare a dedicated Azure subscription

Create a new Azure subscription in your Microsoft Entra tenant. The subscription must:
  • Be attached to an active Azure billing account
  • Be dedicated to one PlanetScale organization
  • Contain no existing workloads or customer-managed infrastructure
  • Allow resource deployment in the Azure regions selected with your Solutions Engineer
Azure VM SKU availability varies by subscription and region. Coordinate region selection with your Solutions Engineer. PlanetScale may ask you to verify that the dedicated subscription has access to the required VM SKUs and sufficient quota across three availability zones in each requested region. The person deploying the bootstrap must have the Azure Owner role on the subscription. Owner is required because the template creates resources, managed identities, a custom role definition, and role assignments. Once PlanetScale begins managing the subscription, do not modify its resources or use your own infrastructure-as-code tooling inside it. Contact support to discuss changes or customization.

​
Step 2: Deploy the PlanetScale bootstrap

The PlanetScale bootstrap is a subscription-scoped Azure Resource Manager (ARM) template generated from a reviewed Bicep source. It has no input parameters and creates no database infrastructure. Deploy the PlanetScale bootstrap to Azure You can also download the ARM template for review before deployment.

​
Deploy through the Azure portal

1
Open the Deploy the PlanetScale bootstrap to Azure link and sign in with the account that has Owner on the dedicated subscription.
2
Select the dedicated subscription. Select the deployment region agreed upon with your PlanetScale Solutions Engineer.
3
Review the template and select Create. The template does not require any parameters.
4
Wait for the subscription deployment to reach Succeeded.

​
Deploy with the Azure CLI

Download the template and deploy it at subscription scope:
Replace <azure-region> with the primary deployment region agreed upon with your Solutions Engineer.

​
Resources and permissions created

The template creates the planetscale-bootstrap resource group and three user-assigned managed identities: The planner and runner identities use federated credentials. The template creates no passwords, client secrets, or database resources.
The runner’s combined permissions are intentionally equivalent to Owner within the dedicated subscription. The subscription is the PlanetScale Managed security boundary and must not contain unrelated resources.

​
Step 3: Collect the deployment output

The deployment outputs the subscription and Microsoft Entra tenant identifiers plus the resource, client, and principal IDs of all three managed identities. These values are identifiers, not credentials or secrets. In the Azure portal:
  1. Open the dedicated Subscription.
  2. Select Deployments.
  3. Open the successful bootstrap deployment.
  4. Select Outputs and copy the managed output.
If you deployed with the Azure CLI, retrieve the same output with:

​
Step 4: Send the onboarding information to PlanetScale

Send your Solutions Engineer:
  • The name and public ID of your PlanetScale organization
  • The complete managed deployment output
  • The Azure region or regions selected for the deployment
Do not send Azure credentials or create client secrets for PlanetScale.

​
Step 5: PlanetScale validates access and provisions the deployment

PlanetScale validates planner and runner federation, confirms the bootstrap identities and role assignments, and then provisions the Managed data plane. PlanetScale may work with you to request regional Azure quota increases based on the selected database products and expected capacity. Do not restrict quotas or resource providers after provisioning begins. Your Solutions Engineer will notify you when provisioning is complete and your team can create databases through the PlanetScale dashboard, API, CLI, or MCP.

​
Step 6: Verify the deployment

After PlanetScale confirms provisioning is complete:
  1. Sign in to the PlanetScale dashboard.
  2. Confirm that the Managed region is available to your organization.
  3. Create or select a database in that region.
  4. Verify a TLS connection through the public endpoint.
  5. If private connectivity is required, contact your Solutions Engineer.
Private database connectivity is available through Azure Private Link or Azure VNet peering (coming soon). Contact your Solutions Engineer to choose an option before provisioning.

​
Need help?

Get help from the PlanetScale Support team, or join our Discord community to see how others are using PlanetScale.