End-to-End Test (VNet Access Required)

Continues from post-deployment-validation.md. Steps 1–3 there must be complete first.

4. VNet Access Setup

⚠️ The remaining tests require connectivity to the VNet.

Use AskUserQuestion: "Steps 1-3 are done. The remaining tests need VNet access. How do you want to proceed?" Options:

• I have a Bastion VM / jump box
• Set up a point-to-site VPN for me — read vpn-dns-setup.md
• I have VPN / ExpressRoute already
• Skip testing for now

Bastion VM: User has direct access to all private endpoints from the VM. Setup is complete — do NOT proceed to Step 5.

---

5. End-to-End Test (VPN users only)

Three phases:

1. Network — DNS resolution + port 443 reachability
2. Agent Lifecycle — Create agent, thread, run, verify, cleanup
3. Isolation Proof — Repeat with VPN off — expect 403

⚠️ Chromium browsers may bypass VPN DNS via Secure DNS (DoH). If portal shows "Error loading agents" but CLI works, disable Secure DNS.

Requirements

pip install azure-ai-projects azure-identity azure-ai-agents

Phase 1: Network Validation

Resolve DNS and test port 443 for all private endpoints. Substitute actual resource names from the deployment.

PowerShell:

$endpoints = @(