> For the complete documentation index, see [llms.txt](https://docs.aohwv.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aohwv.dev/trust-security-and-data-handling/data-residency.md). # Where Your Data Lives AOH Sync is deployed as a **single-tenant virtual machine in your own Azure subscription**. AOH Sync runs entirely inside your own Azure subscription. Your identity data is not sent to the AOH Sync vendor's infrastructure — the only outbound connections are to the Microsoft endpoints and services listed below (and are required for AOH Sync to function). *** ## Single-tenant deployment model When you deploy AOH Sync from the Azure Marketplace, the installation creates all required resources inside the Azure subscription and resource group you control. There is no multi-tenant SaaS backend operated by the AOH Sync vendor that receives or retains copies of your identity data. The complete set of data stores — the identity graph, the relational configuration database, the in-memory cache, and the secret store — run as containers on that VM. All data is written to, read from, and retained on infrastructure that belongs to your subscription. *** ## What runs in your subscription | Component | Location | Purpose | | ------------------------------- | ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | | AOH Sync API | Your Azure VM | Core application logic; reads sources, normalizes identities, provisions Entra | | AOH Sync web UI | Your Azure VM | Browser interface for administrators | | Identity graph database | Your Azure VM | Stores User, Group, Department, Source, and IdentityLifecycleEvent nodes and their relationships | | Configuration database | Your Azure VM | Stores connector configs, provisioning configs, scheduled jobs, sync logs | | In-memory cache | Your Azure VM | Caches live identity data from your source Azure AD and accelerates queries; no data persists if the cache restarts without an explicit persistence configuration | | Vault service | Your Azure VM | Stores connector credentials and other secrets, envelope-encrypted; see [Encryption](/trust-security-and-data-handling/encryption.md) | | Reverse proxy / TLS termination | Your Azure VM | Terminates HTTPS connections; handles certificate management | | Telemetry collector | Your Azure VM | Collects internal observability signals; | *** ## Outbound connections your VM makes AOH Sync makes outbound HTTPS connections from your VM to the following external endpoints: | Destination | Purpose | | ------------------------------------------- | ---------------------------------------------------------------------------------------------------- | | Microsoft Graph API (`graph.microsoft.com`) | Reading identity data from your source Azure AD tenants; provisioning to your target Entra ID tenant | | Microsoft Entra ID token endpoints | Authenticating users (OIDC) and obtaining service tokens for Graph API calls | | Azure Container Registry (ACR) | Pulling updated container images during upgrades | | Azure Blob Storage (onboarding only) | Fetching deployment manifests and compose files during initial installation and upgrades | | AOH Sync license server | Validating your license at startup and periodically thereafter | Microsoft Graph API calls go directly from your VM to Microsoft's endpoints using credentials that you configure in your subscription — no identity data passes through the AOH Sync vendor for those calls. The license server connection is designed to transmit only license key and usage-count metadata, not identity-plane data; however, this has not been independently verified for all flows. *** ## Data sovereignty implications Because all identity data is stored on your VM in your Azure subscription, data residency is determined by the Azure region you selected when deploying the VM. If your organization requires data to remain within a specific geographic region (for example, within the EU or within the United States), you control that by choosing the appropriate Azure region at deployment time. AOH Sync does not impose any geographic restriction or routing that would cause your identity data to pass through a region other than the one where your VM is located. *** ## Related * [The Identity Dataplane](/trust-security-and-data-handling/identity-dataplane.md) * [What Data AOH Sync Stores](/trust-security-and-data-handling/what-data-we-store.md) * [Encryption](/trust-security-and-data-handling/encryption.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.aohwv.dev/trust-security-and-data-handling/data-residency.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.