Azure Deployment

Azure Deployment Options

Azure Container Apps Setup

1. Push Image to Azure Container Registry

# Create ACR
az acr create --name openclawright --resource-group myRG --sku Basic

# Build and push
az acr build   --registry openclawright   --image openclaw:latest   --file Dockerfile .

# Check image is there
az acr repository list --name openclawright

2. Store Secrets in Azure Key Vault

# Create Key Vault
az keyvault create --name openclaw-vault --resource-group myRG --location eastus

# Add API key as secret
az keyvault secret set   --vault-name openclaw-vault   --name openai-api-key   --value "sk-your-key"

# Grant the app's managed identity access
az keyvault set-policy   --name openclaw-vault   --object-id $MANAGED_IDENTITY_OBJECT_ID   --secret-permissions get list

3. Create Container App

# Create Container Apps environment
az containerapp env create   --name openclaw-env   --resource-group myRG   --location eastus

# Deploy OpenClaw
az containerapp create   --name openclaw   --resource-group myRG   --environment openclaw-env   --image openclawright.azurecr.io/openclaw:latest   --registry-server openclawright.azurecr.io   --cpu 0.5   --memory 1.0Gi   --min-replicas 1   --max-replicas 10   --ingress external   --target-port 8080   --env-vars     OPENCLAW_ENV=production     REDIS_URL=rediss://openclaw-cache.redis.cache.windows.net:6380   --secrets openai-api-key=keyvaultref:openclaw-vault/openai-api-key

KEDA Scaling Rules

Azure Container Apps uses KEDA for event-driven autoscaling. Scale based on HTTP concurrency or queue depth:

# Scale based on HTTP concurrent requests
az containerapp update   --name openclaw   --resource-group myRG   --scale-rule-name http-scale   --scale-rule-type http   --scale-rule-http-concurrency 20  # 1 replica per 20 concurrent requests

# container-app.yaml — full scaling configuration
scale:
  minReplicas: 1
  maxReplicas: 10
  rules:
    - name: http-scaling
      http:
        metadata:
          concurrentRequests: "20"

Azure-Native Service Integrations

Managed Identity (No Hardcoded Credentials)

Azure Managed Identity allows Container Apps to call other Azure services without storing credentials anywhere:

# Assign system-assigned managed identity
az containerapp identity assign   --name openclaw   --resource-group myRG   --system-assigned

# Grant it access to Key Vault
az keyvault set-policy   --name openclaw-vault   --object-id $(az containerapp show     --name openclaw     --resource-group myRG     --query "identity.principalId" -o tsv)   --secret-permissions get list

OpenClaw automatically detects and uses Managed Identity when configured with secrets.provider: azure_key_vault.

Service Selection

Azure Container Instances (ACI) is the quickest path to running OpenClaw on Azure — no cluster management, pay per second, suitable for development and low-frequency production workloads. For production at scale, Azure Kubernetes Service (AKS) provides more control over resource allocation, horizontal scaling, and deployment strategies. Azure Container Apps offers an intermediate option with built-in scaling rules, Dapr integration, and managed Kubernetes without direct cluster management. Choose Container Apps for most production deployments unless you have specific reasons to manage AKS directly.

For organizations already using Azure OpenAI Service, OpenClaw can be configured to use Azure OpenAI endpoints by setting the LLM base URL to your Azure endpoint and using your Azure deployment name as the model identifier. This keeps all AI traffic within your Azure tenant, which is often required for data residency compliance and satisfies corporate policies that restrict data from leaving Azure environments.

Identity and Access Management

Use Managed Identity for service-to-service authentication within Azure instead of client secrets or connection strings. A managed identity for your Container Apps deployment automatically authenticates to Azure Key Vault, Azure Storage, and Azure Service Bus without any credential management. Credentials that don't exist in code or configuration can't be leaked. Enable managed identity at deployment time and configure Key Vault access policies to grant your app identity the minimum permissions needed — Key Vault Get for secrets retrieval, no List permission needed in most cases.

Networking and Security

Deploy your OpenClaw containers in a virtual network to control inbound and outbound traffic. Use a Network Security Group to allow inbound traffic only from your expected sources (specific IP ranges or Azure Front Door). Restrict outbound traffic to the domains your agent needs to contact using an Azure Firewall or NSG outbound rules. For agents that should never contact the public internet directamente, use Service Endpoints or Private Endpoints to communicate with Azure services privately without traversing the internet. Document your network topology — the inbound and outbound traffic paths for each agent deployment — and review it during security assessments.

Monitoring with Azure Monitor

Configure Diagnostic Settings on your Container Apps environment to send logs and metrics to a Log Analytics workspace. Query logs using KQL (Kusto Query Language) to analyze agent behavior, error patterns, and performance. Create Azure Alerts based on log query results to notify on-call engineers when error rates spike or p95 latency breaches your SLO threshold. Use Application Insights for distributed tracing across multi-service architectures — it connects the agent run trace through to downstream API calls, giving end-to-end visibility of latency across integrated services.

Quick Start with Container Apps

Deploying to Azure Container Apps requires a Container App Environment (your network boundary) and a Container App resource (your specific deployment). Use the Azure CLI: az containerapp create --name openclaw-agent --resource-group myRG --environment myEnv --image myregistry.azurecr.io/openclaw:latest --cpu 0.5 --memory 1Gi --env-vars OPENCLAW_LLM_API_KEY=secretref:llm-key. The secretref: prefix pulls the value from a Container Apps secret rather than baking it in as a plaintext environment variable. Enable review revision mode to test new container versions before routing all traffic to them.