Skip to main content

​
Nomadic AI on Azure

This page describes how the video analysis platform is deployed in Microsoft Azure, how data moves through it on the read and write paths, how client applications reach it privately over Azure Private Link, and how the offer is transacted through the Azure Marketplace.
Looking to run the whole stack inside your own subscription instead? See Self-Hosted VPC Setup, or deploy the same stack straight from the listing as an Azure managed application. For the other clouds, see Nomadic AI on AWS and Nomadic AI on GCP.

​
General Architecture

The platform runs inside a Nomadic-managed virtual network. Client applications never reach it over the public internet. They create a private endpoint in their own virtual network, which takes a private IP address from one of their subnets and connects to a Private Link service we publish. Everything behind that Private Link service (load balancer, application tier, storage and inference) runs in private subnets with no public IP address.

​
Key Components

Private Link service

The published service a client connects to. Its visibility setting names exactly which Azure subscriptions may request a connection, and each private endpoint connection is approved individually.

Internal load balancer

A Standard SKU internal load balancer with no public IP. Fronts the application tier and is the backend the Private Link service targets.

Application tier

Virtual machine scale set backends. The API service handles authentication, upload and result retrieval. Analysis workers claim queued jobs on a lease and run the analysis out of band.

Data services

Azure Blob Storage for video and derived artifacts, Azure Cosmos DB for job and analysis metadata, Azure Cache for Redis for progress streams, Azure AI Foundry for model inference. All are reached through private endpoints, so no traffic traverses the public internet.

​
Read Path

A client asks for job status, analysis results, or the media behind them. The request enters through the private endpoint and is served from the two data stores inside the virtual network.

​
Read Path Flow

  1. Client application sends the request to the private endpoint in its own subnet, reached by a private IP address and the record in its private DNS zone.
  2. Private Link service accepts the connection from an approved subscription and passes it to the internal load balancer.
  3. API service authenticates the API key and resolves what was asked for: job status, an analysis document, or media.
  4. Azure Cosmos DB and Azure Blob Storage return the analysis document and the video or derived artifacts behind it. Results travel back on the connection the client already opened.

​
Write Path

Upload and analysis are decoupled, so a long-running analysis never holds a client connection open.

​
Write Path Flow

The API service writes video to Azure Blob Storage synchronously and records a job document in Azure Cosmos DB, then returns. The upload is complete at that point. Analysis workers claim the queued job on a lease, marking it in progress so no two workers take the same job, and call Azure AI Foundry for inference. As they run they publish progress events to an Azure Cache for Redis stream, which the API service relays to the client as server-sent events. Finished results are written back to Azure Cosmos DB and derived artifacts to Blob Storage, where the read path picks them up.

​
Private Connectivity

Azure Private Link is two resources, one in each subscription. Nomadic AI publishes the Private Link service; the client creates a private endpoint in their own virtual network. Traffic between them stays on the Microsoft backbone.
  • The connection is one-way. The client initiates. Nomadic AI cannot reach back into the client network, so exposure is limited to the single published service rather than a route between two networks.
  • Consumption is restricted by visibility. The Private Link service names which subscriptions may request a connection, and with manual approval each private endpoint connection request is approved individually.
  • No address-space coordination. A dedicated NAT subnet in our network translates consumer traffic, so the two networks are IP independent and overlapping ranges are irrelevant.
  • DNS is yours to point. Azure does not create records in your network for you. You create a private DNS zone linked to your virtual network with an A record for the endpoint’s private IP, so your SDK resolves it without configuration changes.
  • Nothing needs a public IP. Your side needs no NAT gateway or public address for this path, and our load balancer is internal.
The equivalent primitive on AWS is PrivateLink and on GCP is Private Service Connect. All three follow the same publish-and-consume shape.

​
Azure Marketplace

The Nomadic platform is transacted through the Azure Marketplace, so the subscription is purchased, billed and governed with the rest of your Azure spend rather than through a separate contract and invoice.

​
Offer Types

SaaS offer

You subscribe in the Marketplace and we run the platform. Azure is a procurement and billing channel only; nothing is deployed into your subscription. This is the path for the fully managed and hybrid models.

Azure managed application

The stack deploys into your own subscription from the Marketplace listing, into a managed resource group. This is the path for the in-VNet model when you want the deployment to arrive through the Marketplace rather than through a Terraform handoff.

​
Purchase Flow

  1. Find the offer in the Azure portal under Marketplace, or open the listing link we provide. Negotiated pricing and terms arrive as a private offer visible only to your billing account.
  2. Subscribe against the Azure subscription you want billed, choosing a plan and the number of seats or the usage tier.
  3. Configure the account. Azure sends you to our landing page with a purchase token. Sign in with Microsoft Entra ID, confirm the organization the subscription maps to, and we activate the entitlement.
  4. Start using the platform. Your Marketplace subscription maps to a Nomadic AI organization, and existing API keys and SDK configuration keep working unchanged.
  5. Get billed on your Azure invoice. Charges appear as a Marketplace line item on the subscription you purchased against. Plan changes, seat changes and cancellation are all done from the Azure portal and are reflected in your entitlement.

​
Governance

The listing is live in the Azure Marketplace. Search for Nomadic AI in the Azure portal to subscribe, or contact your Nomadic AI representative to have a private offer prepared for your billing account.

​
Deployment Models

Three options, differing in whose subscription holds the application and whose holds the data.

Fully managed

Nomadic AI runs both the application and the data services in our Azure subscription. Clients connect over Private Link. Lowest operational burden.

In your VNet

The entire stack deploys into your Azure subscription, in a virtual network with no public ingress and no NAT gateway. Video never leaves your subscription and we hold no credentials into it.

Hybrid

We run the application; you supply the storage accounts. Access is granted by a managed identity with Azure RBAC role assignments rather than stored account keys.
Setup steps for the in-VNet model are covered in Self-Hosted VPC Setup.

​
What You Provide

For a Private Link connection to the managed service, the client side needs very little.
Deployments are configured per customer. Contact your Nomadic AI representative with your Azure subscription ID, target region, and preferred deployment model, and we will publish the Private Link service and share its alias along with the Marketplace offer details.