Validation and operations | Session 01: Microsoft Foundry platform baseline, inventory, and landing-zone guardrails

Chapter 6 of 6

Confirm the result#

Rerun preflight once. The Foundry baseline preview must contain no unintended change. The AppInsights project connection may appear as Modify or Deploy because its credential is write-only; stop on any other unexplained change.

Inspect the live assignment:

PowerShell

$scope = az group show --name $resourceGroup --query id --output tsv --only-show-errors
az policy assignment show `
  --name "rvas-s01-guardrails" `
  --scope $scope `
  --query "{scope:scope,enforcementMode:enforcementMode,initiative:policyDefinitionId,metadata:metadata,parameters:parameters}" `
  --output jsonc `
  --only-show-errors

Bash

scope="$(az group show --name "$resource_group" --query id --output tsv --only-show-errors)"
az policy assignment show \
  --name "rvas-s01-guardrails" \
  --scope "$scope" \
  --query '{scope:scope,enforcementMode:enforcementMode,initiative:policyDefinitionId,metadata:metadata,parameters:parameters}' \
  --output jsonc \
  --only-show-errors

The assignment must show the approved resource-group scope, Default enforcement, approved locations and tags, and implementationSession=01-platform-baseline. A DoNotEnforce assignment means the rollout is incomplete.

After implementation#

What remains	Owner
Foundry resource, project, workspace, Application Insights, and connection	Platform owner
Optional BYO VNet foundation	Network owner
Policy initiative, assignment, findings, and exemptions	Cloud platform owner
Bicep, parameters, and scripts	Platform engineering
Live inventory and any classic migration backlog	Platform operations
Promotion, restore, or removal decision	Change authority

The expiryDate tells the owner when to keep or remove the sandbox baseline. Production use needs a separate approval and deployment path.

If enforcement causes an operational problem, redeploy the assignment with DoNotEnforce first. That restores requests while keeping policy visibility.

Remove the marked scope#

Use the approved change path. Confirm implementationSession=01-platform-baseline before removing anything.

Remove the marked policy assignment first. Remove the initiative only when no other assignment uses it. Inventory the resource group and remove only resources owned by this deployment.

Deleted Foundry accounts remain recoverable for 48 hours. Reusing the same name during that window requires an authorized irreversible purge, so prefer recovery or a new approved name.