> ## Documentation Index
> Fetch the complete documentation index at: https://docs.altoura.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview & Deployment Model

> How Altoura Remote Expert is deployed across Altoura's Azure and your tenant, how data flows, and what your IT team configures.

Altoura Frontline is a HoloLens 2 / iPad application that lets a field worker join video calls with Microsoft Teams. The remote expert sees the field worker's video directly in Microsoft Teams; the Altoura meeting extension app is used only for annotations, which are rendered in augmented reality on the field worker's device.

This guide describes the one-time Azure configuration your IT team performs to enable Remote Expert, and explains how data flows and is protected.

## Purpose & Scope

Remote Expert uses a **hybrid deployment model**:

* **Altoura hosts** the Teams web app (meeting extension), the backend / secure API, and the supporting data stores (Azure Blob, Table, and Web PubSub) on Altoura's Azure App Service — the Remote Expert app at `remote-expert-web.altoura.com`.
* **Your organization hosts** the Azure Communication Services (ACS) resource in your own Azure tenant and shares its credentials with Altoura.

Your IT team performs two one-time setup tasks in your tenant:

<CardGroup cols={2}>
  <Card title="Deploy the ACS resource" icon="phone" href="/frontline/administration/remote-expert-it-admin/deploy-acs-resource">
    Create an Azure Communication Services resource and share its keys.
  </Card>

  <Card title="Register the Entra ID app" icon="key" href="/frontline/administration/remote-expert-it-admin/azure-app-registration">
    Register a multitenant app for Teams SSO and Microsoft Graph access.
  </Card>
</CardGroup>

## Who Hosts & Manages What

| Component                             | Hosted in                           | Managed by                            | Notes                                                                                  |
| ------------------------------------- | ----------------------------------- | ------------------------------------- | -------------------------------------------------------------------------------------- |
| Teams web app (front-end)             | Altoura Azure App Service           | Altoura                               | React meeting-extension UI — the Remote Expert app at `remote-expert-web.altoura.com`. |
| Backend / secure API                  | Altoura Azure                       | Altoura                               | Validates SSO tokens, calls Graph on behalf of the user, mints ACS tokens.             |
| Data stores (Blob, Table, Web PubSub) | Altoura Azure                       | Altoura                               | Shared files (Blob), annotations (Table), real-time annotation sync (Web PubSub).      |
| Azure Communication Services (ACS)    | Your Azure tenant                   | Your IT team                          | Real-time audio/video/annotation infrastructure; your resource and keys.               |
| Entra ID app registration             | Your tenant (multitenant)           | Your IT team                          | Teams SSO + Microsoft Graph access; consented per tenant.                              |
| Teams app package (`.zip`)            | Uploaded to your Teams Admin Center | Generated by Altoura, uploaded by you | Preconfigured from the values you share.                                               |

## Data Flow

1. A field worker and a remote expert join a Microsoft Teams meeting and open the Altoura Remote Expert extension (the Altoura-hosted Teams web app).
2. The Teams client requests a single sign-on (SSO) token from Microsoft Entra ID using the multitenant app registration.
3. The web app calls the Altoura backend / secure API with the SSO token. The backend validates the token and identifies the tenant.
4. Acting on behalf of the signed-in user (delegated / on-behalf-of flow), the backend calls Microsoft Graph as needed (contact list for expert search, meeting creation and invites, chat, profile). Using your ACS connection string, it also mints a short-lived ACS access token and returns it to the web app.
5. Session content is stored in Altoura's Azure data stores: shared files in Blob Storage, annotations in Table Storage, with real-time annotation sync via Azure Web PubSub.
6. The web app uses the ACS access token to establish the real-time session against your ACS resource; audio, video, and AR annotations flow between participants.

<Note>
  **All Microsoft Graph access is delegated** — the app acts only as the currently signed-in user, and only for what that user is already permitted to see. Your ACS resource and its media remain in your Azure tenant.
</Note>

## What Data Is Stored, and Where

| Data                                    | Where it is stored                                  | Hosted by                      |
| --------------------------------------- | --------------------------------------------------- | ------------------------------ |
| Shared files (PDFs, 3D models, images)  | Azure Blob Storage (`canvas-uploads` container)     | Altoura                        |
| AR annotations (for late-joiner replay) | Azure Table Storage                                 | Altoura                        |
| Real-time annotation sync (in transit)  | Azure Web PubSub (transport, not long-term storage) | Altoura                        |
| Audio / video / real-time media         | Azure Communication Services                        | Your tenant                    |
| Sign-in identity (tenant, user)         | Derived transiently from the Teams SSO token        | Not persisted by the front-end |

For a full explanation of why ACS and the Entra ID app are provisioned in your tenant, plus answers to common security-review questions, see [Data Security & FAQ](/frontline/administration/remote-expert-it-admin/data-security).

## Next Steps

<Steps>
  <Step title="Deploy the ACS resource">
    [Create an Azure Communication Services resource](/frontline/administration/remote-expert-it-admin/deploy-acs-resource) in your tenant.
  </Step>

  <Step title="Register the Entra ID app">
    [Register the multitenant app](/frontline/administration/remote-expert-it-admin/azure-app-registration) for Teams SSO and Microsoft Graph.
  </Step>

  <Step title="Share the details with Altoura">
    [Collect and securely share](/frontline/administration/remote-expert-it-admin/share-details-with-altoura) the values Altoura needs to generate your Teams app package.
  </Step>
</Steps>