Configuration map

This section explains where SCL configuration lives, which component owns it, and how a configuration problem affects the learner journey. It is a map of the current system, not a secret-management runbook.

Never store client secrets, bearer tokens, APIM keys, connection strings, or personal data in this portal. Use the approved Azure, Azure DevOps, Key Vault, and platform access controls for those values.

Configuration at a glance

Component	Environment-specific configuration	Owner	Main dependencies	Effect of an incorrect configuration
SCL frontend	Static Web App URL, Role Play Evaluation API URL, APIM subscription key, build variables	SCL frontend team	Azure Static Web Apps, Evaluation API, host platform	The application cannot load role-play data, evaluate a session, or complete the deployment
Azure Static Web Apps	Authentication provider, AAD client setting names, routes, CSP, deployment token	Platform/infrastructure team	Microsoft Entra ID, Azure DevOps	Users cannot sign in or the portal is not protected as intended
Role Play Evaluation API	`TableStorage`, `IntegrationCredentials`, `AiFactory`, `LearningPlatformIntegration`, and `Analytics` sections	Backend team	Azure Storage, Integration Credentials, AI Factory, LPI, Analytics	Catalog, voice, evaluation, completion, or telemetry paths fail
API Management	API hostname, product/subscription policy, route prefix, CORS and edge security	Platform/infrastructure team	Evaluation API App Service, certificates, firewall/private networking	Requests are rejected, routed to the wrong service, or bypass the approved edge
`ScaiAgents` table	Agent IDs, SCAI and AI Factory URLs, environment, DNIS, active state	Role Play/backend operations	SCAI, Integration Credentials	The associated Role Play is unavailable or voice/evaluation cannot start
`RolePlays` table	Role Play identity, agent link, blob names, session JSON, optional completion/analytics IDs, active state	Role Play/backend operations	`ScaiAgents`, Blob Storage, Evaluation API	The briefing, voice practice, evaluation, completion, or analytics behaviour is incorrect
Blob containers	`helpinfo`, `evaluationcriteria`, and `roleplayinfo` content files	Role Play/content owners	Azure Blob Storage, Role Plays table	Missing or invalid content produces incomplete briefing/help or weak evaluation behaviour
SCAI	Specialized Role Play agent, default macro-prompt disabled, character behaviour, browser voice channel, DNIS, language, ElevenLabs voice, active state	SCAI team	Approved design handoff, voice provider, browser WebRTC/WebSocket path	The AI may act as a customer-service representative instead of the customer, or the learner cannot establish the voice conversation
Integration Credentials	Environment mappings and protected integration credentials	Integration platform team	SCAI, AI Factory, Analytics	Technical-token acquisition fails for the affected integration
AI Factory	Backend endpoint and model/evaluation integration	AI/evaluation platform team	Evaluation criteria, Integration Credentials	Feedback generation fails or returns an invalid evaluation
Learning Platform Integration	Target platform registration and completion delivery configuration	Learning platform team	Role Play target platform, learner `upn` and `cmid` claims	Feedback can succeed while completion is skipped or delivered asynchronously later
SCL Analytics	Tenant, source, schema, queue and delivery configuration	Analytics/platform team	Role Play analytics tenant, Integration Credentials	The learner flow continues but analytics sessions/events are missing

Frontend configuration

The browser application uses these non-secret configuration names:

Name	Purpose
`VITE_ROLEPLAY_EVALUATION_API_BASE_URL`	Base URL for catalog, evaluation, analytics-proxy, and unload requests
`VITE_ROLEPLAY_EVALUATION_API_SUBSCRIPTION_KEY`	APIM subscription control for the Evaluation API; it is visible in a static browser bundle and is not an authorization boundary
`VITE_INTEGRATION_CREDENTIALS_API_BASE_URL`	Base URL used to obtain SCAI application tokens
`VITE_INTEGRATION_CREDENTIALS_SUBSCRIPTION_KEY`	APIM subscription control for Integration Credentials
`VITE_DEBUG_CONNECTION`	Development-only connection logging switch

The host platform remains responsible for the learner bearer token, iframe launch, token refresh, and microphone permission. See Embed SCL.

Backend configuration sections

The Evaluation API validates critical settings at startup. The names below describe the configuration contract without exposing values:

TableStorage: table names, partition keys, blob container names, queue names, and the protected storage connection string.
IntegrationCredentials: base URL, token path templates, timeout, and protected subscription key.
AiFactory: evaluation request timeout; the endpoint is resolved from the active SCAI agent record.
LearningPlatformIntegration: base URL, audience, timeout, source product/environment, and protected subscription key.
Analytics: base URL, tenant fallback, source ID, schema version, timeout, and protected subscription key.

Configuration is supplied per environment through Azure App Service settings, infrastructure parameters, Azure DevOps variable groups, and managed identities. The repository must contain only safe defaults, examples, and parameter names.

Storage relationships

The catalog is a joined configuration rather than one isolated table row:


SCAI agent in SCAI
        │
        ▼
ScaiAgents row ── ScaiAgentId ──► RolePlays row
                                      │
                                      ├──► helpinfo blob
                                      ├──► evaluationcriteria blob
                                      └──► roleplayinfo blob

The runtime requires both the Role Play and its associated SCAI agent to exist and be active. A Role Play row whose referenced blobs or agent are missing is not a complete publication.

Environment checklist

The frontend points to the APIM hostname for the intended environment.
The API, storage account, queues, and blob containers belong to the same environment.
The ScaiAgents.Environment value matches the Integration Credentials route configuration.
The SCAI team created a specialized Role Play agent, disabled the default customer-service macro-prompt, and configured its DNIS and ElevenLabs voice.
SCAI, AI Factory, LPI, and Analytics endpoints are the approved environment endpoints.
Azure Static Web Apps authentication settings refer to the approved Entra ID registration.
Secrets are injected through the approved secret store or deployment variable group and are not committed to source control.
The public portal and API edge use HTTPS and the approved domain/certificate configuration.

For the manual Role Play publication flow, see Create and provision a role-play. For runtime behaviour, see Architecture and Identity and token hand-off.