After you subscribe

Get your workspace connected

Connect the tools your team already uses. Hires write in your repo. Your tracker stays the source of work. Your cloud stays yours.

Your tools → your VPods team → your work and cloud

GitHub

Your VPods team

LauraFrontend
MarcusBackend
MiraInfrastructure
FrankDeployment
PriyaQA

Jira

Work

AWS / Azure

Cloud

01GitHubCode
02CloudAWS or Azure
03AI teamTeammates
04WorkJira
05ReadyLaunch

01 · Project

Tell us what your team is building

Name the workspace. You can add a short brief. This creates the project the roster will work in — it is not a bill.

Illustrated sample — not your workspace

Harbor Bike Co.

A fake project name used only in this guide

View this step

02 · Connect your tools

Connect the tools your team already uses

GitHub is always first. Cloud and Jira follow your plan.

Required

GitHub

Code. Hires branch, commit, and open pull requests on your repo.

Setup guide

Depends on plan

AWS / Azure

Infrastructure. Your CI deploys into your account.

Setup guide

Depends on plan

Jira

Work. Assignment on your board opens a VPods card.

Setup guide

See requirements by plan

Connect GitHub

1
Authorize
Sign in to GitHub and allow VPods.
2
Pick the repo
The delivery repository hires will use.
3
Confirm
Connect shows GitHub as connected.

Need the implementation details?

OAuth asks for repo and read:user — the delivery repository, not org billing. Reconnect from Settings → Integrations. If OAuth is not registered here, a fine-grained PAT with repo contents and pull requests is the fallback.

AWS

Hires never apply from VPods. Your GitHub Actions pipeline deploys with an identity you launch in your account.

How deployment works

VPods

AI team writes changes

code

GitHub

Your repo and CI

deploy

Your cloud

Your AWS or Azure

CI uses an approved identity you launch. Your cloud stays yours.

1
Launch template
CloudFormation from the Cloud step.
2
Connect identity
Paste the two role ARNs in VPods.
3
Verify
Scale needs deploy and inference, separately.

Need the implementation details?

AWS permissions & IAM

The stack creates two roles. Do not reuse one for both jobs. VPodsDeploy is for GitHub Actions OIDC apply. Policy C covers Amplify, S3, CloudFront, API Gateway, Lambda, DynamoDB, SQS, SNS, ECS/ECR, load balancers, VPC security groups, IAM roles and instance profiles, KMS, Secrets Manager, and SSM. AppSync, RDS, and Route 53 stay on copy-B if you need them. VPods never assumes VPodsDeploy.

Bedrock inference

VPodsInference is assumed by VPods with an ExternalId. Actions: bedrock:InvokeModel, Converse, streams, and inference-profile read. Enable Claude (or the models you use) in Bedrock in that region. Scale cannot continue on deploy alone.

GitHub OIDC

GitHub Actions federates with OIDC into VPodsDeploy. Bind the template to the GitHub org and repo you selected on Connect.

View policy JSON

Azure

Same relationship as AWS: hires write code, your pipeline deploys with a federated identity in your subscription.

How deployment works

VPods

AI team writes changes

code

GitHub

Your repo and CI

deploy

Your cloud

Your AWS or Azure

CI uses an approved identity you launch. Your cloud stays yours.

1
Launch template
ARM / Bicep from the Cloud step.
2
Connect identity
Tenant, subscription, client ID.
3
Grant inference
Foundry roles on a second identity.

Azure permissions & RBAC

The template creates a user-assigned identity with GitHub (and optional Azure DevOps) federated credentials and custom role C: Functions, APIM, Service Bus, Event Grid, storage, Front Door, Static Web Apps, Container Apps, App Service plans, VNets / NSGs / load balancers, ACR, Application Insights, resource groups, and role assignment. Azure SQL, Cosmos DB, DNS, and Key Vault stay on copy-B. No client secret is exchanged for deploy.

Foundry inference

Assign Cognitive Services OpenAI User and Azure AI User on your Azure OpenAI / AI Foundry resource to the VPods enterprise app (the client ID you paste). Do not put those roles on VPodsDeploy. Paste tenant, subscription, client ID, Foundry endpoint, and deployment name.

az role assignment create \
  --role "Cognitive Services OpenAI User" \
  --assignee <vpods-app-object-id> \
  --scope /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.CognitiveServices/accounts/<foundry>

View RBAC JSON

03 · Build your AI team

Assemble the teammates this project needs

Trial includes Laura. Startup picks one licensed hire. Scale builds a roster up to the included ten, then extra paid agents. Unpaid agents cannot be selected.

Virtual agent. VirtualLauraFrontend
Virtual agent. VirtualMarcusBackend
Virtual agent. VirtualMiraInfrastructure
Virtual agent. VirtualFrankDeployment
Virtual agent. VirtualPriyaQA

Explore AI teammates

04 · Connect the work

Bring your work into VPods

Start on an empty VPods board, or connect Jira. Scale expects your tracker. Assignment is what opens a card.

Jira

Assign issue

VPods board

To do
In progress
Review
Done

AI teammate picks it up

Jira

Your existing Jira workflow stays the source of work.

Connect Jira

Jira

VPOD-123

To do

syncs

VPods board

VPOD-123

To do → assign Laura

Laura working

Status moves both ways

1
Connect site
OAuth or API token from Work or Settings.
2
Choose project
Pick the Jira project or space.
3
Map teammates
Each hire maps to a licensed Jira user.

Azure Boards is a separate PAT path when the backlog lives in Azure DevOps — not the same as Azure cloud-connect.

Advanced details

OAuth scopes: read:jira-userread:jira-workwrite:jira-workmanage:jira-webhookoffline_access. An API token needs the same project permissions.

In Jira, create or pick a licensed user for each hire you will assign (Mira, Laura, Frank, …). Those accounts must be assignable on the project.
Connect in VPods, pick the site and project key, then map each hire to that Jira user’s account ID. Reconnect OAuth once so manage:jira-webhook is granted.
Assign or update an issue on the Jira project — VPods opens or moves the matching board card. Moving that card in VPods transitions the Jira issue. Chat still works without the webhook: “Mira, start PROJ-123”.

Members and Entra

People in Microsoft Teams are Entra users. The bot sees an Entra object id. Sync Entra and Jira under Settings → Members so chat maps to this workspace. Website sign-in is still the VPods account; federated SSO is not live. Join is the same email after sync.

Entra and identity guide

05 · You're ready