Chapter 4 of 6 · Decisions and boundaries

Private networking, DNS, and controlled egress

Governed foundation 3 hours in a non-production POC

Chapter 4 of 6

Decisions and stop conditions#

Complete every __REQUIRED_*__ value in a customer working copy. The parameter file needs the approved region, VNet, private-endpoint subnet, five service resource IDs, and expiry date.

The owners must also settle these points before deployment:

DecisionContinue whenStop when
Foundry network patternThe account uses the approved customer-managed delegated subnetThe account uses another subnet, lacks the setting, or Microsoft-managed networking was selected
AddressingThe Agent subnet is dedicated, at least /27, and all ranges are nonoverlapping RFC 1918A range overlaps, the subnet is reused, or the design needs a blanket internet rule
DNSOne owner is authoritative for every required zone, with approved links and hybrid forwardingThe deployment would duplicate a central zone or mixed public/private resolution has no fallback path
EgressThe default route points to one approved firewall and its policy source is namedThe firewall owner has not approved the Microsoft Entra and feature-specific destinations, or TLS inspection injects an untrusted certificate
Identity-provider boundaryThe corporate identity provider terminates at the approved application or APIM boundary, while agents and Azure services use Microsoft Entra workload identitiesA user token is reused as an agent identity, or the design assumes network location grants service access
CutoverEvery private endpoint is approved, private DNS and TCP 443 pass, prior states are recorded, and a restore owner is availableAny check fails or the complete restore record is missing

For central DNS, change main.bicep to reference approved zone resource IDs and remove its local zone and link declarations. Keep the private endpoints and DNS zone groups. The central DNS deployment owns links, forwarding, and records. On-premises DNS cannot query Azure's 168.63.129.16 virtual IP directly.

Portal and Agent Playground users must use the approved execution host or the customer-approved VPN, ExpressRoute, or Bastion path. Their browsers must resolve the same private addresses.

Do not continue after cutover if DNS or TCP 443 fails. Do not remove private connectivity while public access is disabled or while the Foundry account still uses the injected subnet.

Session 02

Private networking, DNS, and controlled egress slide deck