Deployment Lifecycle
Use a staged lifecycle so architecture, identity, infrastructure, application release, security review, and operational ownership are validated separately.
Phases
| Phase | Required outcome |
|---|---|
| 1. Scope and specifications | Approved use cases, deployment model, responsibility matrix, regions, sizing assumptions, security and recovery requirements |
| 2. Access and identity | Customer tenant access, groups, app registrations, workload identities, pipeline identity, approvers |
| 3. Infrastructure | Reviewed infrastructure-as-code deployment, networking, data services, secrets stores, monitoring foundations |
| 4. Delivery pipeline | Build, scan, artifact, approval, deployment, rollback, and environment promotion are tested |
| 5. Application deployment | Versioned services, configuration references, domains, health checks, database changes, background workloads |
| 6. Security and operations review | Public access, private endpoints, RBAC, secret handling, logs, alerts, backups, recovery, cost and quota reviewed |
| 7. Documentation and handover | Inventory, owners, runbooks, support, known risks, training, acceptance evidence |
Production Acceptance
Do not mark a phase complete only because Azure resources exist. Acceptance should include a functional test, security evidence, named owner, known issues, and the next recovery or operational action.
At minimum, test authentication, authorization, ingestion, retrieval, model inference, one approved tool flow, approval, audit correlation, monitoring, backup evidence, and rollback or recovery. Record exceptions with an owner and due date.
Use AI Go-Live Checklist for the agent and governance layer.