# Create a destination for Microsoft Azure + Health Data Services

To populate your <u>**Microsoft Azure**</u> + <u>**Health Data Services**</u> (<u>**HDS**</u>) repository with healthcare data from an EHR system via Redox, you must configure a specific <u>Redox cloud destination</u>. A Redox <u>destination</u> represents where a message is delivered (e.g., like the address in the “To” line of an email header). [Learn more about connecting Redox to your cloud repository](/basics/connecting-to-the-cloud-with-redox).

You’ll need to perform some steps in your cloud product(s) and some in Redox. You can perform Redox setup in our dashboard or with the Redox Platform API. 

## Prerequisites

- Establish a connection with your preferred EHR system. [Learn how to request a connection](/how-to-use-redox/manage-your-redox-setup/request-a-connection-or-subscription).
- Complete your <u>**Azure**</u> and <u>**HDS**</u> configuration _before_ creating your Redox destination. Save any downloads with secret values, since you’ll need to enter some of these details into the Redox dashboard.
- Grant access to Redox from Azure (and any other cloud product) to authorize Redox to push data to your cloud repository.

## Configure in Microsoft Azure

1. Navigate to the Microsoft Azure dashboard and log in. [Review Azure’s quickstart guide](https://learn.microsoft.com/en-us/azure/healthcare-apis/healthcare-apis-quickstart) to get started.
2. Create an application through Microsoft Entra ID. [Review Azure’s help article](https://learn.microsoft.com/en-us/azure/healthcare-apis/register-application).
_This is where you’ll get a client ID and tenant ID, which you’ll need for Redox setup later._
3. Create a new secret for your application. 
_This is where you'll get client secret value, which you'll need for Redox setup later._
4. Use Postman to access the FHIR service in Azure Health Data Services to get these two things for Redox configuration later: 
   1. [Get the capability statement](https://learn.microsoft.com/en-us/azure/healthcare-apis/fhir/use-postman#get-the-capability-statement). 
   2. [Get an access token](https://learn.microsoft.com/en-us/azure/healthcare-apis/get-access-token?tabs=azure-cli#get-an-access-token-for-the-fhir-service) for the FHIR server. 

## Create a cloud destination in Redox

Next, create a <u>cloud destination</u> in your Redox organization. When the EHR system sends healthcare data to Redox, we push it on to your configured Azure + HDS cloud destination.

### In the dashboard

1. For the select destination step, [follow the instructions for creating a cloud destination](https://docs.redoxengine.com/permalink/5FMTxkOE7yrDCBgiqfV3Z7/#create-a-destination). 
2. From the <u>Product type</u> field, select **Health Data Services**.
3. For the configure destination step, populate these fields. Then click the **Next** button. 
   1. <u>FHIR URL</u>: Enter the Azure FHIR endpoint where data should be sent. 
4. For the auth credential step, either a drop-down list of existing auth credentials displays or a new auth credential form opens. [Learn how to create an auth credential ](https://docs.redoxengine.com/how-to-use-redox/manage-your-redox-setup/set-up-auth-credentials/#o-auth-2-0-two-legged-with-secrets)for OAuth 2.0 Two-legged.   


> **Token endpoint URL**
>
> To avoid running into validation errors when sending data to your Azure cloud destination, your auth credential should have a `token endpoint URL` that matches this structure:
>
> `https://login.microsoftonline.com/<tenant id from azure console step 2>/oauth2/v2.0/token`




> **Existing or new auth credential**
>
> Your existing auth credentials will only display if they’re supported for the cloud product type you selected. If you don’t have any supported auth credentials for the cloud type in the current Redox environment, you’ll have to create a new auth credential.


5. For the verify step, [follow the instructions for verifying a destination](https://docs.redoxengine.com/permalink/5FMTxkOE7yrDCBgiqfV3Z7/#step-4-verify-destination). 

### With the Redox Platform API

1. [Review the Create auth credential endpoint](https://docs.redoxengine.com/permalink/dd0240f7-18d1-593d-87a7-d81bf86f543c-create-auth-cred).
2. In your terminal, prepare the `/v1/authcredentials` request.
3. Specify these required values in the request. These may not be noted as required fields in our API spec, but these are what’s required for working with Azure.
   - Locate the `audience` (<u>FHIR metadata endpoint</u>) and `clientID` (<u>Application ID</u>) on the <u>Overview</u> page of the Microsoft Azure dashboard. 
The `audience` value is equivalent to the <u>FHIR metadata endpoint</u> value. However, you must remove `metadata` at the end and replace it with either `Bundle` or `fhir`. For Redox, you should use `Bundle`.
   - Locate the `clientSecret` value on the <u>Certificates & Secrets</u> page of the Microsoft Azure dashboard when you’re creating a user. This value only displays once, so make sure you store it. Note that this isn’t the same as the secret ID value. 

**Example: Create auth credential for Azure + Health Data Services**

```json
curl 'https://api.redoxengine.com/platform/v1/authcredentials' \
--request POST \
--header 'Authorization: Bearer $API_TOKEN' \
--header 'accept: application/json' \
--header 'content-type: application/json' \
--data '{
    "organization": "<Redox_organization_id>"
    "name": "<human_readable_name_for_auth_credential>"
    "environmentId": "<Redox_environment_ID>"
    "authStrategy": "OAuth_2.0_2-legged"
    "audience": "<FHIR_metadata_endpoint_from_Azure>" 
    "resourceURI": "<FHIR_metadata_endpoint_from_Azure>"
    "clientId": "<client_id_from_Azure>"
    "clientSecret": "<client_secret_from_Azure>"
    "grantType": "client_credentials"  
    "url": "https://login.microsoftonline.com/<tenant id from azure console_step-2>/oauth2/v2.0/token"
    "scope": "https://storage.azure.com/.default"
  }

```


4. You should get a successful `200` response and a `payload` populated with the details of the new auth credential.
5. [Review the Create destination endpoint](https://docs.redoxengine.com/permalink/96830826-bf9c-5d5a-878c-b5b3f1402f30-create-destination).
6. In your terminal, prepare the `/v1/environments/{environmentId}/destinations` request with these values: 
   - Set `authCredential` to the auth credential ID from the response you received in step #4.  
   - Populate `cloudProviderSettings` with the settings below.
     - Enter the Azure FHIR endpoint to send to for the FHIR base URL.


**Example: Values for Azure + HDS cloudProviderSettings**

```json
{
  "cloudProviderSettings": {
    "typeId": "azure",
    "productId": "health-data-services", 
    "settings": {
      "fhirBaseUrl": "<FHIR_endpoint>"
     }
  }
}
```


7. You should get a successful `200` response with a `payload` populated with the details of the new Azure cloud destination. Specifically, the `verified` status of the destination should be set to `true`. 
8. Your new destination will now be able to receive messages. FHIR data is validated against the FHIR standard schema to ensure compliance since HDS enforces strict adherence to FHIR rules. Once validated, data is securely stored in Azure’s FHIR datastore, which can be queried.


> **Troubleshooting tip**
>
> If the destination is verified but data delivery fails, check the Redox logs for FHIR validation errors returned by Azure.