Use your own domain
A new Private Enterprise installation uses Azure-provided HTTPS addresses ending in azurewebsites.net, with certificates Azure issues and renews. Many organizations prefer addresses on their own domain, such as veriproof.customer.com.
Custom hostnames aren’t configurable in the installer yet. Your installation’s sign-in callback, allowed browser origin, and OAuth addresses are set from the Azure-provided hostnames at install time, so binding a custom domain by hand breaks sign-in and is overwritten by the next upgrade. Keep the Azure-provided addresses until a release adds custom hostname settings; the steps below let you prepare now.
Choose your hostnames
VeriProof has three public addresses. We recommend one subdomain for each:
| Address | Example | Used by |
|---|---|---|
| Portal | veriproof.customer.com | People signing in to VeriProof |
| API | api.veriproof.customer.com | Your applications, through the VeriProof SDK |
| MCP | mcp.veriproof.customer.com | AI agents and tools that connect over MCP |
What you’ll need
- DNS access for your domain. For each hostname you’ll add a CNAME record pointing at the installation’s Azure hostname, and a TXT record Azure uses to verify you own the domain. You keep using your existing DNS provider; VeriProof never needs registrar or DNS credentials.
- No certificate purchase. Each hostname gets a free Azure App Service managed certificate, which Azure renews automatically. If your policy requires a wildcard or exportable certificate, use one from your own Key Vault instead.
- An Entra change. Your VeriProof app registration needs the sign-in and sign-out addresses on the new portal and API hostnames.
What changes when custom hostnames are supported
When a release adds custom hostname settings, the process will be:
- Enter your three hostnames in the managed application’s parameters.
- Publish the CNAME and TXT records the installation shows for each hostname.
- Azure validates each hostname and issues its managed certificate.
- Add the new sign-in and sign-out addresses to your app registration.
- Sign in on the new portal address, send a test event through the new API address, and connect an MCP client to the new MCP address.
The Azure-provided addresses keep working throughout, so you can switch back if anything doesn’t check out. Release notes will say when this is available.