Serverless Azure OpenAI Quick Start with LlamaIndex
(JavaScript)

This sample shows how to quickly get started with LlamaIndex for TypeScript on Azure. The application is hosted on Azure Container Apps. You can use it as a starting point for building more complex RAG applications.

(Like and fork this sample to receive lastest changes and updates)

Features

This project demonstrates how to build a simple LlamaIndex application using Azure OpenAI. The app is set up as a chat interface that can answer questions about your data. You can add arbitrary data sources to your chat, like local files, websites, or data retrieved from a database. The app will ingest any supported files you put in ./data/ directory. This sample app uses LlamaIndex.TS that is able to ingest any PDF, text, CSV, Markdown, Word and HTML files.

Architecture Diagram

This application is built around a single component:

• A full-stack Next.js application that is hosted on Azure Container Apps in just a few commands. This app uses LlamaIndex.TS, a TypeScript library that can ingest any PDF, text, CSV, Markdown, Word and HTML files.

• The app uses Azure OpenAI to answer questions about the data you provide. The app is set up to use the gpt-35-turbo model and embeddings to provide the best and fastest answers to your questions.

Getting Started

You have a few options for getting started with this template. The quickest way to get started is GitHub Codespaces, since it will setup all the tools for you, but you can also set it up locally. You can also use a VS Code dev container

This template uses gpt-35-turbo version 1106 which may not be available in all Azure regions. Check for up-to-date region availability and select a region during deployment accordingly

• We recommend using swedencentral

GitHub Codespaces

You can run this template virtually by using GitHub Codespaces. The button will open a web-based VS Code instance in your browser:

1. Open the template (this may take several minutes)

2. Open a terminal window

3. Sign into your Azure account:

    azd auth login

4. Provision the Azure resources and deploy your code:

    azd up

5. Install the app dependencies:

    npm install

VS Code Dev Containers

A related option is VS Code Dev Containers, which will open the project in your local VS Code using the Dev Containers extension:

1. Start Docker Desktop (install it if not already installed)

2. Open the project:

3. In the VS Code window that opens, once the project files show up (this may take several minutes), open a terminal window.

4. Sign into your Azure account:

    azd auth login

5. Provision the Azure resources and deploy your code:

    azd up

6. Install the app dependencies:

    npm install

7. Configure a CI/CD pipeline:

   azd pipeline config

To start the web app, run the following command:

npm run dev

Open the URL http://localhost:3000 in your browser to interact with the bot.

Local Environment

Prerequisites

You need to install following tools to work on your local machine:

• Docker
• Node.js LTS
• Azure Developer CLI
• Git
• PowerShell 7+ (for Windows users only)
  • Important: Ensure you can run pwsh.exe from a PowerShell command. If this fails, you likely need to upgrade PowerShell.
  • Instead of Powershell, you can also use Git Bash or WSL to run the Azure Developer CLI commands.
• This template uses gpt-35-turbo version 1106 which may not be available in all Azure regions. Check for up-to-date region availability and select a region during deployment accordingly
  • We recommend using swedencentral

Then you can get the project code:

1. Fork the project to create your own copy of this repository.
2. On your forked repository, select the Code button, then the Local tab, and copy the URL of your forked repository.
3. Open a terminal and run this command to clone the repo: git clone <your-repo-url>

Quickstart (with Azure OpenAI models)

1. Bring down the template code:

   azd init --template llama-index-javascript

   This will perform a git clone

2. Sign into your Azure account:

    azd auth login

3. Install all dependencies:

    npm install

4. Provision and deploy the project to Azure:

   azd up

5. Configure a CI/CD pipeline:

   azd pipeline config

Once your deployment is complete, you should see a .env file at the root of the project. This file contains the environment variables needed to run the application using Azure resources.

Local Development

To run the sample, run the following commands, which will start the Next.js app.

1. Open a terminal and navigate to the root of the project, then run app:

    npm run dev
   

Open the URL http://localhost:3000 in your browser to interact with the Assistant.

CI/CD configuration (passwordless)

The workflows in .github/workflows/ authenticate to Azure with GitHub OIDC + Microsoft Entra ID federated credentials. They do not use a static client secret or an Azure OpenAI API key.

Required repository variables

Configure these under Settings → Secrets and variables → Actions → Variables:

Variable	Used by	Notes
AZURE_CLIENT_ID	both workflows	App registration (service principal) client ID
AZURE_TENANT_ID	both workflows	Entra ID tenant ID
AZURE_SUBSCRIPTION_ID	both workflows	Target Azure subscription
AZURE_ENV_NAME	azure-dev.yml	azd environment name
AZURE_LOCATION	azure-dev.yml	Azure region (e.g., swedencentral)
AZURE_OPENAI_ENDPOINT	ai-opsec-agent.yml	Endpoint URL of the Azure OpenAI resource (not a secret)

Required Azure-side configuration

1. Federated credential on the app registration (AZURE_CLIENT_ID) trusting this repo's main branch and pull requests. azd pipeline config will create this for you.
2. Entra ID authentication enabled on the Azure OpenAI resource (AZURE_OPENAI_ENDPOINT).
3. Role assignment: grant the service principal the Cognitive Services OpenAI User role on the Azure OpenAI resource so the OpSec workflow can request an access token.

Secrets that must not be set

These are deliberately unused. If they exist in repo settings, delete them:

• AZURE_CREDENTIALS (client-secret JSON — replaced by federated credentials)
• AZURE_OPENAI_API_KEY (replaced by an Entra ID access token obtained at runtime)
• AZURE_OPENAI_ENDPOINT (endpoint URL — should be an Actions variable, not a secret)

Guidance

Region Availability

This template uses gpt-35-turbo version 1106 which may not be available in all Azure regions. Check for up-to-date region availability and select a region during deployment accordingly

• We recommend using swedencentral

Costs

Pricing varies per region and usage, so it isn't possible to predict exact costs for your usage. However, you can use the Azure pricing calculator for the resources below to get an estimate.

• Azure Container Apps: Consumption plan, Free for the first 2M executions. Pricing per execution and memory used. Pricing
• Azure OpenAI: Standard tier, GPT and Ada models. Pricing per 1K tokens used, and at least 1K tokens are used per question. Pricing

Warning

To avoid unnecessary costs, remember to take down your app if it's no longer in use, either by deleting the resource group in the Portal or running azd down --purge.

Security

Important

This is a sample. Review it against your own security requirements before you put real data in ./data or expose it to users.

Authentication

Every API route (/api/chat, /api/chat/upload, /api/files/*, /api/sandbox, /api/chat/config) checks the caller before it reads files, touches the index, or calls Azure OpenAI. The AUTH_MODE environment variable controls the check:

AUTH_MODE	Behavior
unset	npm run dev allows anonymous access so local development keeps working. npm start and the container image reject every API request with 401.
easyauth	Requires the X-MS-CLIENT-PRINCIPAL-ID header that Azure Container Apps built-in authentication sets for signed-in users. Only set this when built-in authentication is enabled and requires sign-in. Container Apps strips that header from client requests only when built-in authentication is on.
anonymous	No authentication. Don't use this on a public endpoint. It's only for local testing or when another gateway authenticates every request.

Turn on sign-in for your deployment

A fresh azd up deploys an app whose API returns 401 until you turn on sign-in:

1. In the Azure portal, open the llama-index-javascript container app in the rg-<env-name> resource group.

2. Go to Settings > Authentication > Add identity provider, pick Microsoft, and let it create a new app registration. Keep Require authentication and HTTP 302 Found redirect.

3. Tell the app to trust the signed-in user headers:

   az containerapp update --name llama-index-javascript --resource-group rg-<env-name> --set-env-vars AUTH_MODE=easyauth

azd provision and azd up reset the container's environment variables, so run step 3 again after either one. The authentication settings from step 2 stay in place.

Credentials

Note

When implementing this template please specify whether the template uses Managed Identity or Key Vault

This template has either Managed Identity or Key Vault built in to eliminate the need for developers to manage these credentials. Applications can use managed identities to obtain Microsoft Entra tokens without having to manage any credentials. Additionally, we have added a GitHub Action tool that scans the infrastructure-as-code files and generates a report containing any detected issues. To ensure best practices in your repo we recommend anyone creating solutions based on our templates ensure that the Github secret scanning setting is enabled in your repos.

Resources

Here are some resources to learn more about the technologies used in this sample:

• LlamaIndexTS Documentation - learn about LlamaIndex (Typescript features).
• Generative AI For Beginners
• Azure OpenAI Service
• Azure OpenAI Assistant Builder
• Chat + Enterprise data with Azure OpenAI and Azure AI Search

You can also find more Azure AI samples here.

Troubleshooting

If you can't find a solution to your problem, please open an issue in this repository.

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.