Implementation | Session 01: Microsoft Foundry platform baseline, inventory, and landing-zone guardrails

Chapter 5 of 6

Implement#

1. Complete the inputs and mark the resource group#

Replace every __REQUIRED_*__ value in the environment parameter files. Use an ISO yyyy-MM-dd expiry date.

Inspect the group before changing it:

PowerShell

$resourceGroup = "rg-rvas-s01-sandbox"
$location = "<approved-region>"
az group show --name $resourceGroup --query "{id:id,location:location,tags:tags}" --output jsonc

Bash

resource_group="rg-rvas-s01-sandbox"
location="<approved-region>"
az group show --name "$resource_group" --query '{id:id,location:location,tags:tags}' --output jsonc

If the group does not exist, create it through the approved change path. Merge the session marker and governance tags without removing existing tags:

PowerShell

$resourceGroupId = az group show --name $resourceGroup --query id --output tsv --only-show-errors
az tag update `
  --resource-id $resourceGroupId `
  --operation Merge `
  --tags `
    implementationSession=01-platform-baseline `
    environment=sandbox `
    businessOwner="<team-alias>" `
    technicalOwner="<team-alias>" `
    dataClassification="<synthetic-classification>" `
    criticality="<approved-value>" `
    costCenter="<sandbox-cost-code>" `
    expiryDate="<yyyy-MM-dd>" `
  --only-show-errors

Bash

resource_group_id="$(az group show --name "$resource_group" --query id --output tsv --only-show-errors)"
az tag update \
  --resource-id "$resource_group_id" \
  --operation Merge \
  --tags \
    implementationSession=01-platform-baseline \
    environment=sandbox \
    businessOwner="<team-alias>" \
    technicalOwner="<team-alias>" \
    dataClassification="<synthetic-classification>" \
    criticality="<approved-value>" \
    costCenter="<sandbox-cost-code>" \
    expiryDate="<yyyy-MM-dd>" \
  --only-show-errors

2. Resolve the built-ins and run preflight#

Resolve the current allowed-location and required-tag policy definitions:

PowerShell

$builtIns = .\scripts\resolve-builtins.ps1 | ConvertFrom-Json
$env:RVAS_ALLOWED_LOCATIONS_POLICY_ID = $builtIns.allowedLocations.id
$env:RVAS_REQUIRE_TAG_POLICY_ID = $builtIns.requireTag.id

Bash

built_ins="$(./scripts/resolve-builtins.sh)"
export RVAS_ALLOWED_LOCATIONS_POLICY_ID="$(
  python3 -c 'import json,sys; print(json.load(sys.stdin)["allowedLocations"]["id"])' <<<"$built_ins"
)"
export RVAS_REQUIRE_TAG_POLICY_ID="$(
  python3 -c 'import json,sys; print(json.load(sys.stdin)["requireTag"]["id"])' <<<"$built_ins"
)"

Run preflight:

PowerShell

.\scripts\preflight.ps1 `
  -ResourceGroupName $resourceGroup `
  -DeploymentName "rvas-s01-baseline" `
  -DeploymentLocation $location `
  -ConfirmInheritedPolicyReview

Bash

./scripts/preflight.sh \
  --resource-group-name "$resource_group" \
  --deployment-name "rvas-s01-baseline" \
  --deployment-location "$location" \
  --confirm-inherited-policy-review

Preflight rejects unresolved values, wrong scopes, inconsistent tag settings, changed built-ins, missing providers, Bicep errors, and unexpected deployment previews.

3. Deploy the optional network foundation and baseline#

For byo-vnet, deploy the network foundation first. Set its agentSubnetResourceId output in sandbox.bicepparam. Skip this deployment for the other network patterns.

PowerShell

az deployment group create `
  --resource-group $resourceGroup `
  --name "rvas-s01-network-foundation" `
  --parameters .\artifacts\environments\network-foundation.bicepparam `
  --only-show-errors

az deployment group create `
  --resource-group $resourceGroup `
  --name "rvas-s01-baseline" `
  --parameters .\artifacts\environments\sandbox.bicepparam `
  --only-show-errors

Bash

az deployment group create \
  --resource-group "$resource_group" \
  --name "rvas-s01-network-foundation" \
  --parameters ./artifacts/environments/network-foundation.bicepparam \
  --only-show-errors

az deployment group create \
  --resource-group "$resource_group" \
  --name "rvas-s01-baseline" \
  --parameters ./artifacts/environments/sandbox.bicepparam \
  --only-show-errors

For a non-BYO-VNet pattern, run only the baseline deployment command.

4. Update the customer inventory#

List the deployed resources:

PowerShell

az resource list `
  --resource-group $resourceGroup `
  --query "[].{name:name,type:type,location:location,id:id,tags:tags}" `
  --output json

Bash

az resource list \
  --resource-group "$resource_group" \
  --query "[].{name:name,type:type,location:location,id:id,tags:tags}" \
  --output json

Platform operations updates the customer inventory with the live details. When classic assets are already known to be in scope, the platform owner records confirmed migration candidates in the customer backlog. Classic discovery is not part of the normal deployment path.

5. Stage and promote the guardrails#

Deploy the initiative and capture its ID:

PowerShell

az deployment sub create `
  --location $location `
  --name "rvas-s01-guardrails-initiative" `
  --parameters .\artifacts\environments\initiative.bicepparam `
  --only-show-errors

$env:RVAS_INITIATIVE_DEFINITION_ID = az deployment sub show `
  --name "rvas-s01-guardrails-initiative" `
  --query properties.outputs.initiativeDefinitionId.value `
  --output tsv `
  --only-show-errors

Bash

az deployment sub create \
  --location "$location" \
  --name "rvas-s01-guardrails-initiative" \
  --parameters ./artifacts/environments/initiative.bicepparam \
  --only-show-errors

export RVAS_INITIATIVE_DEFINITION_ID="$(
  az deployment sub show \
    --name "rvas-s01-guardrails-initiative" \
    --query properties.outputs.initiativeDefinitionId.value \
    --output tsv \
    --only-show-errors
)"

Rerun preflight, then deploy the assignment with enforcementMode = 'DoNotEnforce':

PowerShell

az deployment group create `
  --resource-group $resourceGroup `
  --name "rvas-s01-guardrails-assignment" `
  --parameters .\artifacts\environments\policy-assignment.bicepparam `
  --only-show-errors

Bash

az deployment group create \
  --resource-group "$resource_group" \
  --name "rvas-s01-guardrails-assignment" \
  --parameters ./artifacts/environments/policy-assignment.bicepparam \
  --only-show-errors

Trigger a policy scan and review current findings:

PowerShell

az policy state trigger-scan --resource-group $resourceGroup --no-wait --only-show-errors
az policy state list `
  --resource-group $resourceGroup `
  --query "[].{state:complianceState,reference:policyDefinitionReferenceId,resource:resourceId}" `
  --output table `
  --only-show-errors

Bash

az policy state trigger-scan --resource-group "$resource_group" --no-wait --only-show-errors
az policy state list \
  --resource-group "$resource_group" \
  --query '[].{state:complianceState,reference:policyDefinitionReferenceId,resource:resourceId}' \
  --output table \
  --only-show-errors

Policy evaluation is asynchronous. Keep DoNotEnforce while findings are stale or unexplained. After the cloud platform owner completes the review and the change authority approves enforcement, change the assignment parameter to Default, rerun preflight, and redeploy the same assignment.

Commit the approved Bicep, parameter files, and scripts. Keep live inventory, approvals, exemptions, and command responses in the customer systems.