---
title: Installation
description: Choose the deployment model that fits your security and compliance needs.
icon: Download
---

1Security offers flexible deployment options to meet your organization's compliance, data residency, and operational requirements. You can choose to run 1Security as a fully managed SaaS (Cloud), deploy it within your own Azure environment (BYOC), or host it fully On-Premise.

## Prerequisites

Regardless of your chosen deployment method, you will need:

- A **Microsoft 365 tenant** with at least one license that includes SharePoint Online (Business Basic upwards - no E5 required)
- **Global Administrator** access (for the initial OAuth consent)
- Modern browser (Chrome, Edge, Firefox, Safari - last two major versions)

<Callout type="info">
  Full detail - which license SKUs qualify, which admin roles are used and when,
  every permission each module requests, and the four features that need a
  premium Microsoft SKU - is in [Requirements](/en/docs/requirements).
</Callout>

## Deployment Models

<Tabs items={['Cloud (SaaS)', 'BYOC (Azure)', 'On-Premise']}>
  <Tab value="Cloud (SaaS)">
    **Recommended for most teams.** 
    
    1Security manages the infrastructure, updates, and maintenance. You simply log in and connect your tenant.

    - **Zero infrastructure** to manage.
    - **Continuous updates** with no downtime.
    - Setup takes less than 5 minutes.
    - Hosted in secure, SOC 2 Type II compliant environments.

    ### Getting Started
    
    <Steps>
      <Step>
        ### Create your account
        Go to [1security.ai](https://1security.ai) and sign up using your Microsoft work account. We use OAuth - your password never leaves Microsoft.
      </Step>
      <Step>
        ### Grant tenant permissions
        During the consent dialog, an admin in your tenant approves the permissions 1Security needs to read your Microsoft 365 metadata. We never request write access to user data without an explicit per-action prompt.
      </Step>
      <Step>
        ### Run your first scan
        Once connected, the platform automatically queues an initial scan. You'll see results stream in over the next few minutes.
      </Step>
    </Steps>

  </Tab>

  <Tab value="BYOC (Azure)">
    **Bring Your Own Cloud** is ideal for organizations with strict data residency requirements that want to keep all processed data inside their own Azure tenant, while still using our managed Docker images.
    
    ### Architecture Overview
    Docker images are provided pre-built from 1Security's Azure Container Registry. You will receive access credentials to pull images directly to your environment.
    
    **Required Azure Services:**
    - **Azure App Service (Linux)**: 2 instances (API + Client)
    - **Azure App Service Plan**: Separate compute plans for API and Client recommended.
    - **Azure Database for PostgreSQL**: Flexible Server recommended over Single Server.
    - **Azure Key Vault** (Optional): Secure storage for secrets and certificates.
    - **Azure Storage Account** (Optional): File share for certificate mounting.

    ### Resource Specifications & Estimated Costs
    Tenant scans are CPU and memory-intensive. Below are recommended specs based on active users (costs exclude discounts like Reserved Instances, which can reduce prices by ~60%):

    | Tenant Size | API Server | Client App | PostgreSQL | Estimated Monthly Cost |
    | :--- | :--- | :--- | :--- | :--- |
    | **Small** (< 350 users) | **P2V3** (2 vCPU, 8GB RAM) | **P1V2** (1 vCPU, 3.5GB RAM) | **Standard_D2s_v3** (2 vCores, 8GB RAM) | ~$355 / month |
    | **Medium** (350-1,000 users) | **P3V3** (4 vCPU, 16GB RAM) | **P2V3** (2 vCPU, 8GB RAM) | **Standard_D2s_v3** (2 vCores, 8GB RAM) | ~$580 / month |
    | **Large** (1,000+ users) | **P3V3** (4 vCPU, 16GB RAM) | **P2V3** (2 vCPU, 8GB RAM) | **Standard_D4s_v3** (4 vCores, 16GB RAM) | ~$840+ / month |

    ### Required Permissions
    To set up the BYOC deployment, the administrator needs:
    - **Azure Subscription**: Contributor role (or Resource Group Owner).
    - **Entra ID**: Application Admin or Cloud Application Admin (to create App Registrations and grant consent).
    - **Specific Resources**: App Service Contributor, Key Vault Admin, PostgreSQL Contributor.

    *Contact our support team to receive your ACR credentials and the complete BYOC deployment manifests.*
  </Tab>

  <Tab value="On-Premise">
    **Fully self-hosted deployment** for organizations with air-gapped environments or ultimate infrastructure control needs.

    - **Total control** of data location and network boundaries.
    - **Air-gapped** installation supported.
    
    ### Minimum Hardware Requirements
    - **Compute**: 16 vCPU
    - **Memory**: 64 GB RAM
    - **Storage**: 500 GB SSD (NVMe recommended)

    *Contact our enterprise sales team to plan an on-premise deployment.*
  </Tab>
</Tabs>

<Callout type="warn">
  Granting consent requires **Global Administrator** privileges. If you're not a
  global admin, ask one to complete the consent flow - you can still own
  day-to-day operations afterwards.
</Callout>

## Verifying the install

After the consent flow and environment setup finish, you should land on the dashboard with at least the following populated:

- **Tenant** card showing your tenant ID and domain
- **Scan status** showing "Running" or "Queued"
- **Users** count matching what you see in the Microsoft 365 admin centre (give it a minute to sync)

If any of these are missing, see [connecting tenants](/en/docs/connecting-tenants) for troubleshooting.