Audience: Datatoc users and desktop administrators · Platform: Windows
Before you begin: You need a supported Windows computer, the current Datatoc installer from your organisation's approved channel, a Microsoft account authorised for the service, and internet access for sign-in and cloud-assisted operations.
Install Datatoc
Close any open Datatoc window.
Open Datatoc-Setup-<version>.exe.
Review the publisher information shown by Windows.
Choose the installation scope described below.
Select the installation directory when that option is available.
Select Install.
Start Datatoc from the Start menu or desktop shortcut.
Choose the Installation Scope
Only for me
Choose this when Datatoc is used by one Windows account, you are installing on a personal computer, or your organisation permits self-service installation. Application and runtime data are maintained for the current Windows user.
Anyone who uses this computer
Choose this when the computer is shared by multiple Windows users, IT manages software centrally, or your administrator has approved a computer-wide installation. Administrator approval is normally required.
First Start
Datatoc opens with the product name, the tagline Ask, Analyze, Reuse., and Sign in with Microsoft. The desktop application is delivered with its service connection already configured. Normal users do not configure Azure services or provide technical deployment settings.
Update Datatoc
Finish or save current work and close Datatoc.
Open the newer installer from the same approved source.
Use the same installation scope as the existing installation.
Start Datatoc and confirm sign-in and an existing workspace work normally.
Updating Datatoc does not remove user-selected workspace folders. Protect important workspaces using your normal backup process.
Uninstall Datatoc
Close Datatoc.
Open Windows Settings > Apps > Installed apps.
Find Datatoc, select Uninstall, and follow the prompts.
Workspace folders are not automatically deleted. Review them separately when removing project data.
Organisation-Managed Installation
IT teams can distribute Datatoc with Microsoft Intune, Configuration Manager, a company software portal, or another approved Windows deployment service. Administrators should validate the installer signature, installation scope, sign-in, upgrade behaviour, endpoint-security compatibility, and service connectivity before organisation-wide rollout.
User Guide
Sign In and First Use
Audience: Datatoc users
Sign In
Open Datatoc.
Select Sign in with Microsoft.
Choose the Microsoft account authorised for Datatoc.
Complete multifactor authentication or other verification requested by Microsoft or your organisation.
Return to Datatoc after Microsoft confirms the sign-in.
Datatoc does not collect your Microsoft password. Authentication is completed entirely through Microsoft's sign-in service.
Create Your First Workspace
A workspace keeps related data, projects, scripts, cleaning history, visualisations, and saved outputs together.
Select the option to create a workspace.
Enter a clear workspace name.
Choose a folder where your Windows account has read and write access.
Confirm the workspace location.
A Documents folder or another organisation-approved working folder is normally appropriate. Avoid Windows system folders and the Datatoc installation directory.
Import Data
Open the workspace data area.
Select a CSV or supported Excel file.
Review the detected columns and preview.
Confirm the dataset you want to use.
Prepare Variables
Datatoc can help profile columns and create reusable variable definitions.
Review each source column.
Generate AI suggestions when useful.
Confirm or edit the variable name, data type, unit, and description.
Save the approved mappings to the workspace.
Review AI suggestions before saving, especially units, dates, identifiers, categories, and missing-value interpretations.
Clean Data
Use standard cleaning controls or the cleaning assistant to prepare a dataset. Describe each cleaning step in plain English, see the result on your actual data, decide whether it looks right, and save it. Accepted outputs are recorded in the workspace and can be inspected and reused on future files.
Analyse Data
Open an analysis conversation or standard analysis tool.
Select the intended dataset.
Describe the question clearly, including relevant variables, filters, units, or comparison groups.
Review the generated explanation, script, table, and visualisation.
Save useful scripts and outputs with meaningful names.
AI-generated analysis can contain errors. Confirm important calculations, filters, units, and conclusions before using results for a decision or publication.
Reuse Your Work
Saved variable mappings, scripts, cleaning history, and analysis outputs can be reused within the workspace. When a new dataset has matching source variables, review the proposed mappings before applying them.
Data Location and Processing
Workspace files and accepted outputs are stored in the folder selected by the user. Cloud-assisted features process the information required to perform the operation requested by the user. Use Datatoc in accordance with your organisation's data-classification, privacy, retention, and acceptable-use requirements.
Architecture
Architecture and Deployment
Audience: Azure, identity, security, and desktop administrators · Last reviewed: August 2026
This guide describes the supported deployment procedure and the configuration values an administrator must record. It does not document Datatoc source code or internal implementation.
Deployment Options
Datatoc-managed Service
Datatoc provides the cloud service and a connected desktop installer. Users install the application and sign in. The customer does not deploy any Azure resources.
Customer-managed Deployment
Your organisation deploys the approved Datatoc cloud release in its own cloud subscription and controls identity, region, access, monitoring, networking, and cost. This guide covers this option in detail.
Administrator Roles
Responsibility
Typical Role
Subscription and resource deployment
Cloud subscription or resource-group administrator
Application registration and consent
Identity / directory application administrator
Model selection and quota
AI Foundry administrator
Security and networking approval
Cloud security or platform team
Desktop distribution
Endpoint-management administrator
Normal Datatoc users do not need any cloud subscription access.
Deployment Sequence (Azure)
Stage
Step
Outcome
1
Resource group, managed identity
2
API registration, desktop registration, delegated permission, roles
3
Project endpoint, model deployment, managed-identity role
4
Session pool endpoint and executor role
5
Versioned image in the approved registry
6
Healthy Datatoc cloud service and successful configuration check
7
Approved installer connected to the stable service URL
8
Test user assigned to a Datatoc role
9
End-to-end validation
Sign-in, profiling, cleaning, analysis, and save tests pass
Production Readiness Checklist
All cloud resources show a successful provisioning state.
The Datatoc managed identity has only the required resource-scoped roles.
The cloud service is reachable through its approved stable hostname.
The service health and configuration checks succeed.
An assigned test user can sign in from the packaged desktop application.
An unassigned test user is denied access with an appropriate message.
Profiling, cleaning, analysis, and code execution complete successfully.
Results can be saved, the application can be restarted, and the workspace can be reopened.
Monitoring, alerting, cost controls, release records, and rollback steps are in place.
Security and privacy review is complete.
Enterprise Deployment
Prerequisites and Naming
Audience: Cloud administrators · Outcome: A resource group and managed identity ready for Datatoc · Last reviewed: August 2026
Select your cloud provider
Required Access
The administrator performing the deployment needs permission to: create resources in the selected subscription and resource group, create app registrations and grant tenant consent, assign cloud RBAC roles to the Datatoc managed identity, and deploy models in the selected region.
Required Tools
Azure CLI 2.79.0 or later
Azure CLI containerapp extension
Docker Desktop (for local image builds) or Azure Container Registry Tasks (for cloud builds)
PowerShell 7 (recommended)
PowerShell
az version
docker version
Define Deployment Variables
Run this block in the PowerShell window used for the deployment. Replace every placeholder and use names that meet your organisation's standards.
Do not use latest as the only production image tag. An immutable release or commit tag makes verification and rollback possible.
Register Resource Providers
PowerShell
az provider register --namespace Microsoft.App --wait
az provider register --namespace Microsoft.CognitiveServices --wait
az provider register --namespace Microsoft.ContainerRegistry --wait
az provider register --namespace Microsoft.ManagedIdentity --wait
az config set extension.use_dynamic_install=yes_without_prompt
az extension add --name containerapp --upgrade --allow-preview false
Create the Resource Group
PowerShell
az group create `
--name $RESOURCE_GROUP `
--location $LOCATION `
--tags application=Datatoc environment=Production
Create the Managed Identity
This identity is attached to the Datatoc Cloud API. It pulls the private image and authenticates to AI services without storing credentials in the application.
PowerShell
az identity create `
--resource-group $RESOURCE_GROUP `
--name $IDENTITY_NAME `
--location $LOCATION
$IDENTITY_ID = az identity show --resource-group $RESOURCE_GROUP --name $IDENTITY_NAME --query id --output tsv
$IDENTITY_CLIENT_ID = az identity show --resource-group $RESOURCE_GROUP --name $IDENTITY_NAME --query clientId --output tsv
$IDENTITY_PRINCIPAL_ID = az identity show --resource-group $RESOURCE_GROUP --name $IDENTITY_NAME --query principalId --output tsv
Record the resource ID, client ID, and principal ID in the private deployment record. The principal ID is used for cloud RBAC role assignments.
AWS Deployment Guide — Coming Soon
Datatoc currently supports enterprise deployment on Microsoft Azure. AWS deployment documentation is planned for a future release. The core architecture (containerised cloud API, managed identity, AI model integration) maps closely to equivalent AWS services.
Datatoc currently supports enterprise deployment on Microsoft Azure. Google Cloud documentation is planned for a future release. Contact our team if you need guidance on your specific environment.
Datatoc's architecture is designed to be cloud-portable. If you are deploying on a different cloud provider, contact our enterprise team and we will help you map the deployment steps to your environment.
Audience: Identity / directory administrators · Outcome: Protected API, public desktop client, and role-based user access · Last reviewed: August 2026
Select your cloud provider
Two app registrations: Datatoc uses a Datatoc Cloud API registration (protected backend, exposes the access_as_user scope, defines app roles) and a Datatoc Desktop registration (public client, no client secret). The desktop registration requests delegated access to the Cloud API.
Register the Cloud API
Open Microsoft Entra admin center.
Go to Identity > Applications > App registrations and select New registration.
Enter Datatoc Cloud API.
Select Accounts in this organizational directory only.
Leave Redirect URI empty and select Register.
Record the Application (client) ID, Directory (tenant) ID, and application Object ID.
Expose the API Scope
In the Cloud API registration, open Expose an API.
Set the Application ID URI to api://<cloud-api-client-id>.
Select Add a scope and set the scope name to access_as_user.
Use consent text such as Access Datatoc as the signed-in user.
Enable and save the scope.
Add App Roles
Display Name
Value
Purpose
Datatoc User
Datatoc.User
Normal application access
Datatoc Administrator
Datatoc.Admin
Datatoc application administration
Register the Desktop Client
Return to App registrations, select New registration, and enter Datatoc Desktop.
Select the same supported account type as the Cloud API.
After registering, open Authentication > Add a platform > Mobile and desktop applications.
AWS deployment documentation (including IAM, Cognito, or similar identity services) is planned for a future release. Contact our team for guidance on your specific environment.
Audience: Cloud administrators · Outcome: Secure, isolated code execution for AI-generated scripts · Last reviewed: August 2026
Datatoc runs AI-generated Python scripts in an isolated execution environment. Each analysis or cleaning operation runs in a dedicated session that is created on demand and destroyed when the operation completes. User data and generated code never persist between sessions.
Select your cloud provider
Datatoc uses Azure Container Apps Dynamic Sessions to run AI-generated Python scripts in isolated, per-user-operation containers.
EgressDisabled is the recommended setting for production. It prevents AI-generated scripts from making outbound network requests. Review this setting against your security policy.
Retrieve the Pool Endpoint
PowerShell
$SESSION_POOL_ENDPOINT = az containerapp sessionpool show `
--name $SESSION_POOL `
--resource-group $RESOURCE_GROUP `
--query properties.poolManagementEndpoint `
--output tsv
Assign the Managed Identity Role
PowerShell
$SESSION_POOL_ID = az containerapp sessionpool show `
--name $SESSION_POOL `
--resource-group $RESOURCE_GROUP `
--query id --output tsv
az role assignment create `
--role "Azure ContainerApps Session Executor" `
--assignee-object-id $IDENTITY_PRINCIPAL_ID `
--assignee-principal-type ServicePrincipal `
--scope $SESSION_POOL_ID
AWS Code Execution — Coming Soon
AWS-based isolated code execution (such as AWS Lambda or Fargate-based sandboxes) is planned for a future release.
Audience: Cloud and DevOps administrators · Last reviewed: August 2026
Select your cloud provider
Create the Container Registry
PowerShell
az acr create `
--name $ACR_NAME `
--resource-group $RESOURCE_GROUP `
--location $LOCATION `
--sku Standard `
--admin-enabled false
$ACR_LOGIN_SERVER = az acr show `
--name $ACR_NAME `
--query loginServer --output tsv
Grant Image Pull Permission
PowerShell
$ACR_ID = az acr show --name $ACR_NAME --query id --output tsv
az role assignment create `
--role "AcrPull" `
--assignee-object-id $IDENTITY_PRINCIPAL_ID `
--assignee-principal-type ServicePrincipal `
--scope $ACR_ID
Publish the Datatoc Image
The Datatoc cloud image is supplied by the Datatoc release team or an authorised distribution channel. Do not build or publish a custom image without explicit approval.
PowerShell — Cloud build (no local Docker required)
# Using Azure Container Registry Tasks
az acr build `
--registry $ACR_NAME `
--image "$IMAGE_NAME`:$IMAGE_TAG" `
--file Dockerfile `
.
Amazon ECR — Coming Soon
Documentation for publishing and managing the Datatoc container image in Amazon Elastic Container Registry is planned for a future release.
The bootstrap response must report is_configured: True, foundry_configured: True, and session_pool_configured: True. Record $APP_URL as the approved stable service URL.
AWS ECS / Fargate Deployment — Coming Soon
AWS ECS or Fargate-based deployment documentation is planned for a future release.
Audience: Endpoint-management and desktop administrators · Last reviewed: August 2026
The Datatoc desktop application is a Windows installer that ships with a cloud.json configuration file pointing to the organisation's approved Datatoc Cloud API URL. End users sign in with Microsoft — no manual configuration is required on the user's side.
Configure cloud.json
The installer package must include a cloud.json file that points to the stable Cloud API URL recorded after the container app deployment.
Never place secrets, access tokens, or client secrets in cloud.json. Only include the approved stable service URL and any required non-sensitive metadata.
Distribution Methods
Microsoft Intune
Package as a Win32 app using the Intune Win32 App Packaging Tool. Assign to approved user or device groups. Use detection rules to verify the installed version.
Company Software Portal
Upload the signed installer to an approved company portal. Users install on demand. IT manages the available version and receives download telemetry.
Validation Before Rollout
Validate the installer signature against the Datatoc release record.
Confirm sign-in works end-to-end for a test user in the organisation.
Confirm an unassigned user receives an appropriate denial message.
Test upgrade from a previous version without data loss.
Verify endpoint-security and antivirus compatibility.
Enterprise Deployment
User Access and Operations
Audience: IT service owners, identity administrators, and cloud operators · Last reviewed: August 2026
Grant Access to an Employee
Open the identity admin center.
Go to Enterprise applications and select Datatoc Cloud API.
Open Users and groups and select Add user/group.
Choose the user or an approved directly assigned security group.
Select Datatoc.User or Datatoc.Admin and complete the assignment.
The user should close Datatoc and sign in again so the new app-role claim appears in a newly issued access token.
Grant Access to an External Account
Invite the external user's Microsoft account and send the invitation.
Ask the user to accept the invitation from email or the organisation's access panel.
Assign the guest user to the Datatoc enterprise application role.
An invitation alone does not grant Datatoc access. The role assignment is still required.
Remove Access
Remove the user from the assigned Datatoc group or enterprise application assignment. For urgent revocation, follow the organisation's session-revocation and incident-response procedure. Removing cloud access does not delete workspace files stored on the user's computer.
Create monitoring alerts for: no healthy service replicas, elevated error rates (5xx, 401, 403), container restart or startup failures, AI model throttling or quota exhaustion, execution session failures, abnormal request duration, and unexpected cost growth.
Architecture
Security, Privacy and Data Handling
Audience: Security, privacy, risk, and compliance teams · Last reviewed: August 2026
This page provides product and deployment guidance. Contractual security, privacy, residency, retention, and service commitments are defined by the applicable Datatoc agreement and selected cloud service terms.
Identity and Access
Users authenticate through Microsoft identity services.
Enterprise administrators control Datatoc access through identity assignments and roles.
Multifactor authentication, Conditional Access, guest-user lifecycle, and access reviews are available to the customer in a customer-managed deployment.
Normal Datatoc users do not require any cloud subscription access.
Cloud service access is assigned to the Datatoc managed identity using resource-scoped RBAC.
Local Workspace Data
Users choose the local folder used for Datatoc workspaces. Workspace content can include imported data, mappings, project information, saved scripts, cleaning outputs, visualisations, and exported results. Local protection follows Windows and organisational controls, including device encryption, endpoint security, folder permissions, and data-loss prevention.
Cloud-assisted Processing
AI-assisted profiling, cleaning, analysis, and code execution process the information required for the operation requested by the user. Customer-managed deployments select and govern the cloud environment used for that processing. Organisations should define the data classifications approved for Datatoc and communicate those requirements to users through their normal data-governance programme.
Security Review Checklist
Identity audience, tenant, expiry, and application-role validation reviewed.
Managed-identity roles scoped to the required cloud resources.
User and guest access-review process established.
Approved data classifications documented.
Network and code-execution egress policy approved.
Container image provenance and vulnerability process approved.
Monitoring, alerting, and log-retention controls enabled.
Desktop signing, update, and rollback process approved.
Audience: Datatoc users, support teams, and enterprise administrators · Last reviewed: August 2026
For Users
Datatoc Cannot Connect
Confirm the computer has internet access.
Select Try again.
Close and reopen Datatoc.
Confirm the VPN or company network is connected when required.
Ask your administrator whether other Datatoc users are affected.
Microsoft Sign-in Does Not Open
Confirm a default web browser is available.
Check whether a Microsoft sign-in window opened behind another window.
Temporarily close duplicate sign-in windows and try again.
Confirm browser pop-up, proxy, or firewall policy is not blocking Microsoft sign-in.
Install the current Datatoc release from the approved distribution channel.
Sign-in Succeeds but Datatoc Denies Access
Your Microsoft identity may be valid but not assigned to a permitted Datatoc role. Contact the Datatoc administrator and sign in again after the assignment is corrected.
An AI Operation Does Not Complete
Confirm the correct dataset is selected.
Check whether the dataset or prompt is unusually large.
Retry the operation once after a short interval.
Try a smaller, non-sensitive test dataset to determine whether the problem is data-specific.
Contact support if the same operation continues to fail.
A Generated Script Reports a Missing Column
A message such as KeyError: '<column>' means the script expected a column not present in the selected dataset. Compare the dataset's current columns with the variables referenced by the analysis, then edit or regenerate the analysis using the current dataset.
For Administrators
A Revision Will Not Start
PowerShell
az containerapp revision list `
--name $CONTAINER_APP `
--resource-group $RESOURCE_GROUP `
--output table
az containerapp logs show `
--name $CONTAINER_APP `
--resource-group $RESOURCE_GROUP `
--type console --follow
Common causes: wrong target port, image-pull permission, missing environment variable, unsupported image architecture, or an application import error.
Bootstrap Returns is_configured: False
One or more required environment variables are missing or incorrect. Verify each variable listed in the page against the values recorded during deployment.
Sign-in Fails with AADSTS Errors
Error Code
Likely Cause
Resolution
AADSTS50011
Incorrect redirect URI
Confirm http://localhost is added in the desktop registration
AADSTS65001
Admin consent not granted
Grant admin consent for the access_as_user permission
AADSTS50020
Personal Microsoft account used
Use the organisational account authorised for the service
AADSTS700016
Application not found in tenant
Confirm the tenant ID and client ID match the deployment record