Chapter 4 of 6
Decisions and stop conditions#
Complete every __REQUIRED_*__ value in a customer working copy. The parameter file needs the approved region, VNet, private-endpoint subnet, five service resource IDs, and expiry date.
The owners must also settle these points before deployment:
| Decision | Continue when | Stop when |
|---|---|---|
| Foundry network pattern | The account uses the approved customer-managed delegated subnet | The account uses another subnet, lacks the setting, or Microsoft-managed networking was selected |
| Addressing | The Agent subnet is dedicated, at least /27, and all ranges are nonoverlapping RFC 1918 | A range overlaps, the subnet is reused, or the design needs a blanket internet rule |
| DNS | One owner is authoritative for every required zone, with approved links and hybrid forwarding | The deployment would duplicate a central zone or mixed public/private resolution has no fallback path |
| Egress | The default route points to one approved firewall and its policy source is named | The firewall owner has not approved the Microsoft Entra and feature-specific destinations, or TLS inspection injects an untrusted certificate |
| Identity-provider boundary | The corporate identity provider terminates at the approved application or APIM boundary, while agents and Azure services use Microsoft Entra workload identities | A user token is reused as an agent identity, or the design assumes network location grants service access |
| Cutover | Every private endpoint is approved, private DNS and TCP 443 pass, prior states are recorded, and a restore owner is available | Any check fails or the complete restore record is missing |
For central DNS, change main.bicep to reference approved zone resource IDs and remove its local zone and link declarations. Keep the private endpoints and DNS zone groups. The central DNS deployment owns links, forwarding, and records. On-premises DNS cannot query Azure's 168.63.129.16 virtual IP directly.
Portal and Agent Playground users must use the approved execution host or the customer-approved VPN, ExpressRoute, or Bastion path. Their browsers must resolve the same private addresses.
Do not continue after cutover if DNS or TCP 443 fails. Do not remove private connectivity while public access is disabled or while the Foundry account still uses the injected subnet.