Release v4.3.0 · Azure/agent-landing-zone

Changed

Add opt-in persistent firewall DNS proxy configuration through
ENABLE_FIREWALL_DNS_PROXY, defaulting to false without changing client DNS.
Gate network-isolated native Foundry IQ Blob ingestion on the exact Search
shared private links being approved and successfully provisioned. Pending
links fail with administrator approval instructions; no unrelated or
target-side connections are approved automatically.
Honor explicit empty native Blob ingestion permission options for deliberately
shared, non-ADLS sources while retaining protected defaults and rejecting
unsupported or ambiguous configurations.
Pin UI v3.3.0 for ingestion-aware upload controls and early server-side
attachment rejection when the ingestion application is disabled. Text chat,
authentication and retrieval remain available.
Complete build-subnet-only HTTPS egress for the pinned Microsoft npm feeds
and package-download CDN without requiring firewall DNS proxy.
Make the ingestion Container App an independent, explicit deployment choice.
Fresh supported native-ingestion deployments omit it; existing and custom
deployments retain their prior component choices. Disabling deployment does
not delete existing applications or document data.

Offline platform, panel and Search suite: 707 passed, 4 skipped, 868 subtests.
Exact released UI binding and deployment compatibility: 206 passed, 178 subtests; release metadata and binding checks repeated after versioning.
Bicep compilation and scoped networking contracts passed; compiled foundation is 4.487 MiB, below the existing 4.7 MiB failure threshold.
UI v3.3.0 source, installed-wheel and offline-container CI passed; all five quality gates reported zero findings.
Central operator documentation was aligned and its strict build passed.
Azure deployment, live-environment validation and ACR/cloud builds were intentionally omitted.