Chapter 6 of 6
Confirm the result#
Run the connectivity check again from the approved execution host:
PowerShell
.\scripts\connectivity-check.ps1 `
-ParameterPath .\artifacts\environments\sandbox.bicepparamBash
./scripts/connectivity-check.sh \
--parameter-path ./artifacts/environments/sandbox.bicepparamEvery configured alias must resolve only to RFC 1918 IPv4 addresses and accept TCP 443. The script prints the result and saves no file.
After implementation#
| What remains | Owner |
|---|---|
| approved VNet, subnets, route, and private endpoints | Network owner |
| Private DNS zones, links, and hybrid forwarding | DNS owner |
| Customer firewall rules and source reference | Firewall owner |
| Service private endpoints and public-access settings | Affected service owners |
| Five-service cutover and restore record | Cutover and restore owners |
| Bicep, parameters, and scripts | Network engineering |
Keep this control in the approved nonproduction scope. Production needs separate address, DNS, firewall, service-owner, and change-window decisions. The governed-agent deployment must still test agent-runtime traffic.
If access must be restored, the network, DNS, firewall, security, and service owners review the approved change record with the change authority. Restore each recorded public-access state first, then rerun the connectivity check.
Restoring public access does not detach the injected subnet. Keep the Agent subnet, route, and VNet until a separately approved Foundry account retirement and purge is complete. Do not remove a marked DNS link or private endpoint when a service remains private-only, when a recorded prior state is not Enabled, or when no other approved access path exists.