Install SSS DocGen at a client

One managed solution + Azure rendering API + a few config values. ~30 min.

What ships in the managed solution (`solution/dist/SSSDocGen_managed.zip`)

Component	Purpose
`sss_documenttemplate` / `sss_templatedataset` tables	Template + dataset config (the "what to render")
`sss_GenerateDocument` custom API	Entry point: `Code` + `EntityId` in, PDF (base64) out
`SssDocGenPlugins` plugin assembly	Thin proxy: custom API → Azure rendering API
5 environment-variable definitions	`sss_DocGenApiBaseUrl`, `sss_DocGenTenantId`, `sss_DocGenClientId`, `sss_DocGenScope`, `sss_DocGenClientSecret` (values set per env)
`SSS DocGen API` security role	Grants the API's app user read access to run dataset FetchXML
`sss_docgen_generate.js` web resource	Command-bar action that calls the custom API + downloads the PDF
`GenerateInvoice` command	"Generate Document" button on the invoice table

The button ships on invoice. To add it to other tables, see step 6.

Prerequisites

Target Dataverse environment (client's).
An Entra app registration + Azure rendering container (run infra/setup-azure.ps1 — see deployment-runbook.md). This produces the 5 values below.
PAC CLI installed.

Fast path (one command)

infra/setup-dataverse.ps1 does the whole Dataverse half — import + env-var values + app user + role + seed + health check:

./infra/setup-dataverse.ps1 -EnvUrl https://<client>.crm4.dynamics.com -ApiBaseUrl https://<container>.azurecontainerapps.io -TenantId <tenant> -ClientId <app-id>

You're prompted for the client secret (never passed on the command line). It ends with a green/red health check. The manual steps below are the same thing, broken out — use them to troubleshoot or run piecemeal.

Steps (manual)

1. Import the solution

pac solution import --path solution/dist/SSSDocGen_managed.zip --publish-changes

2. Confirm the alternate key is active

sss_documenttemplate → Keys → sss_code_key must reach Active (async after import). The custom API resolves templates by Code through this key.

3. Set the 5 environment variable values

Maker portal → Solutions → SSS DocGen → each environment variable → Edit → set value:

Variable	Value	From
`sss_DocGenApiBaseUrl`	`https://<container-app>.azurecontainerapps.io`	setup-azure output
`sss_DocGenTenantId`	Entra tenant GUID	setup-azure output
`sss_DocGenClientId`	Entra app (client) ID	setup-azure output
`sss_DocGenScope`	`<client-id>/.default` (v2 token)	setup-azure output
`sss_DocGenClientSecret`	client secret (plain text)	Key Vault — retrieve locally, never route through chat

4. Create the API application user + assign the role

Power Platform admin center → target env → Settings → Users + permissions → Application users → New app user → pick the Entra app (sss_DocGenClientId) → assign the SSS DocGen API security role. This is how the Azure API reads Dataverse to run dataset queries.

5. Seed templates

npm run seed -- --all --env <env>

Seeds every template under templates/. For a single product group, seed by code: npm run seed <code> -- --env <env>.

6. (Optional) Add the button to other tables

The button ships on invoice. For another table: maker portal → table → Edit command bar → + New command → Run JavaScript → library sss_docgen_generate.js, function SssDocGen.generate, parameter PrimaryControl.

Verify

npm run health -- --env <env>

Resolves a template, grabs a sample record of its target table, calls sss_GenerateDocument, and asserts a real PDF comes back — exit 0 green / 1 red. Or manually: open an invoice → Generate Document → pick a template → a PDF downloads.

Notes

If the client's environment has no invoice table, the command import may warn — the runtime (tables, API, plugin) still installs; add the button to a table the client does have (step 6).
The rendering API is per-environment (its own Azure container + Entra app). One shared API can serve multiple environments if each has an app user in that environment's Dataverse.