Where Your Data Lives
AOH Sync is deployed as a single-tenant virtual machine in your own Azure subscription. AOH Sync runs entirely inside your own Azure subscription. Your identity data is not sent to the AOH Sync vendor's infrastructure — the only outbound connections are to the Microsoft endpoints and services listed below (and are required for AOH Sync to function).
Single-tenant deployment model
When you deploy AOH Sync from the Azure Marketplace, the installation creates all required resources inside the Azure subscription and resource group you control. There is no multi-tenant SaaS backend operated by the AOH Sync vendor that receives or retains copies of your identity data.
The complete set of data stores — the identity graph, the relational configuration database, the in-memory cache, and the secret store — run as containers on that VM. All data is written to, read from, and retained on infrastructure that belongs to your subscription.
What runs in your subscription
AOH Sync API
Your Azure VM
Core application logic; reads sources, normalizes identities, provisions Entra
AOH Sync web UI
Your Azure VM
Browser interface for administrators
Identity graph database
Your Azure VM
Stores User, Group, Department, Source, and IdentityLifecycleEvent nodes and their relationships
Configuration database
Your Azure VM
Stores connector configs, provisioning configs, scheduled jobs, sync logs
In-memory cache
Your Azure VM
Caches live identity data from your source Azure AD and accelerates queries; no data persists if the cache restarts without an explicit persistence configuration
Vault service
Your Azure VM
Stores connector credentials and other secrets, envelope-encrypted; see Encryption
Reverse proxy / TLS termination
Your Azure VM
Terminates HTTPS connections; handles certificate management
Telemetry collector
Your Azure VM
Collects internal observability signals;
Outbound connections your VM makes
AOH Sync makes outbound HTTPS connections from your VM to the following external endpoints:
Microsoft Graph API (graph.microsoft.com)
Reading identity data from your source Azure AD tenants; provisioning to your target Entra ID tenant
Microsoft Entra ID token endpoints
Authenticating users (OIDC) and obtaining service tokens for Graph API calls
Azure Container Registry (ACR)
Pulling updated container images during upgrades
Azure Blob Storage (onboarding only)
Fetching deployment manifests and compose files during initial installation and upgrades
AOH Sync license server
Validating your license at startup and periodically thereafter
Microsoft Graph API calls go directly from your VM to Microsoft's endpoints using credentials that you configure in your subscription — no identity data passes through the AOH Sync vendor for those calls. The license server connection is designed to transmit only license key and usage-count metadata, not identity-plane data; however, this has not been independently verified for all flows.
Data sovereignty implications
Because all identity data is stored on your VM in your Azure subscription, data residency is determined by the Azure region you selected when deploying the VM. If your organization requires data to remain within a specific geographic region (for example, within the EU or within the United States), you control that by choosing the appropriate Azure region at deployment time.
AOH Sync does not impose any geographic restriction or routing that would cause your identity data to pass through a region other than the one where your VM is located.
Related
Last updated