Azure Portal Validation Evidence

Azure Portal Validation Evidence

This page defines the evidence to collect after a successful deployment. The goal is to prove that the lab deployed as designed without exposing secrets, subscription identifiers, or sensitive environment values.

Use this page with:

• End-to-End Deployment Walkthrough
• Testing and Validation
• Monitoring and Diagnostics
• Security Operations

Evidence Rules

• Redact subscription IDs, tenant IDs, object IDs, public IPs, usernames, email addresses, and resource IDs if you publish screenshots.
• Prefer resource names, resource types, tags, and high-level status.
• Do not capture secret values, connection strings, access keys, SAS tokens, passwords, private keys, or Terraform state.
• Capture the selected profile and commit SHA with every evidence package.

Evidence Index

Evidence	Required for cheap-lab	Required for lab or prod
GitHub Actions successful plan	Yes	Yes
GitHub Actions successful apply	Yes	Yes
Resource group list	Yes	Yes
VNet and subnet list	Yes	Yes
Peering list	Yes	Yes
Public IP review	Yes	Yes
Private endpoint review	When enabled	Yes
Log Analytics workspace	Yes	Yes
Diagnostic settings	Yes for deployed services	Yes
Policy compliance	When policy enabled	Yes
Cost budget	When cost management enabled	Yes
App Gateway backend health	No unless enabled	Yes when App Gateway enabled
Firewall policy/rules	No unless enabled	Yes when Firewall enabled

Azure CLI Evidence Commands

Set placeholders locally without documenting real values:

$env:AZURE_SUBSCRIPTION_ID = "<subscription-id>"
az account set --subscription $env:AZURE_SUBSCRIPTION_ID

Resource groups:

az group list --query "[?contains(name, 'azlab')].{name:name, location:location, tags:tags}" -o table

VNets:

az network vnet list --query "[].{name:name, rg:resourceGroup, address:addressSpace.addressPrefixes}" -o table

Peerings:

az network vnet peering list --resource-group <hub-resource-group> --vnet-name <hub-vnet-name> --query "[].{name:name, state:peeringState, remote:remoteVirtualNetwork.id}" -o table

Public IP review:

az network public-ip list --query "[].{name:name, rg:resourceGroup, allocation:publicIPAllocationMethod}" -o table

Private endpoints:

az network private-endpoint list --query "[].{name:name, rg:resourceGroup, subnet:subnet.id, state:provisioningState}" -o table

Diagnostic settings for a known resource:

az monitor diagnostic-settings list --resource <resource-id> -o table

Portal Screenshot Checklist

Portal blade	Capture	Redact
Resource groups	Names, locations, tags, resource counts	Subscription ID
Virtual networks	Address spaces and subnets	Resource IDs if visible
Peerings	Connected state	Full remote IDs if sensitive
Public IP addresses	Count and names only	Actual public IP values
Private endpoints	Names, linked service, connection state	Private IP if your org treats it as sensitive
Log Analytics	Workspace name, retention, daily cap	Workspace ID
Diagnostic settings	Resource names and enabled categories	Resource IDs
Policy	Assignment names and compliance status	Principal IDs
Cost Management	Budget name and threshold	Email recipients and billing IDs
App Gateway	Backend health summary	Public frontend IP

Pass/Fail Evidence Matrix

Control	Pass evidence	Fail evidence
No public RDP	No public IP on jumpbox, no RDP NAT, no broad NSG rule	RDP path from internet exists
Private-first PaaS	Private endpoint exists and public access disabled where expected	Public data-plane access remains open
Hub-spoke peering	Peering state is Connected	Peering missing or disconnected
Monitoring	Workspace and diagnostic settings exist	Resource deployed without diagnostics
Cost guardrail	Budget exists or high-cost toggles disabled	Expensive resources enabled without budget
CI/CD safety	Plan/apply runs show OIDC and gated checks	Client secret JSON or skipped gates

Evidence Folder Naming

When storing evidence outside the wiki, use a sanitized structure:

evidence/
  cheap-lab/
    2026-06-13/
      workflow-plan.md
      workflow-apply.md
      resource-inventory-redacted.md
      portal-screenshots-redacted/

Do not commit raw evidence until it has been reviewed for secrets and identifiers.

Validation Notes Template

# Validation Evidence

- Profile: cheap-lab
- Commit: <commit-sha>
- Plan run: <github-actions-url>
- Apply run: <github-actions-url>
- Reviewer: <initials>

## Results

| Area | Result | Notes |
|---|---|---|
| Networking | Pass | Hub and spokes exist; peerings connected |
| Security | Pass | No public RDP; private endpoints enabled |
| Monitoring | Pass | Workspace exists; diagnostics verified |
| Cost | Pass | Expensive services disabled |

Next page: Production Readiness Review