Provision, rename, re-region, verify or tear down the Azure environment for DATACON 2026 Demo 3 — "the control plane is the security perimeter" (Private Link + Entra-only Azure SQL Hyperscale + a client VM whose managed identity is the server admin). USE WHEN the presenter says any of: "build the private link demo", "provision demo 3", "set up the control plane demo", "deploy the privatelink demo on this machine", "rebuild demo 3", "move demo 3 to another region", "rename the demo 3 server", "the VM got deallocated, redeploy it", "run pre-flight for demo 3", "why is 05-verify failing", "tear down demo 3", or moves this talk to a new laptop and needs the VNet + VM + Entra-only server + demo kit in place. Scope is PROVISION + CONFIGURE + VERIFY + TEARDOWN ONLY. Do NOT use to present or rehearse the five beats (that's run-privatelink-demo), to build the Adventure Works / SQL MCP kit, or to deploy the Ward General hyperscale talk — those are separate.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Provision, rename, re-region, verify or tear down the Azure environment for DATACON 2026 Demo 3 — "the control plane is the security perimeter" (Private Link + Entra-only Azure SQL Hyperscale + a client VM whose managed identity is the server admin). USE WHEN the presenter says any of: "build the private link demo", "provision demo 3", "set up the control plane demo", "deploy the privatelink demo on this machine", "rebuild demo 3", "move demo 3 to another region", "rename the demo 3 server", "the VM got deallocated, redeploy it", "run pre-flight for demo 3", "why is 05-verify failing", "tear down demo 3", or moves this talk to a new laptop and needs the VNet + VM + Entra-only server + demo kit in place. Scope is PROVISION + CONFIGURE + VERIFY + TEARDOWN ONLY. Do NOT use to present or rehearse the five beats (that's run-privatelink-demo), to build the Adventure Works / SQL MCP kit, or to deploy the Ward General hyperscale talk — those are separate.
Build the Private Link (Demo 3) environment
Read presentations/dataconus2026/whyazurebest/demos/demo3_controlplane/README.md
first, every time. It is the source of truth and it is current. This skill covers
only what the README does not: the order to work in and the traps that have
already cost a rebuild.
All paths are workspace-relative to the bwsql root. Kit:
presentations/dataconus2026/whyazurebest/demos/demo3_controlplane/.
The shape of it
Control plane runs on the laptop, az only. The laptop never opens a SQL
connection — it cannot, by design.
Data plane runs inside the VM, sqlsim only. The VM never runs az.
az vm run-command invoke bridges the two through ARM. It keeps working even
after publicNetworkAccess=Disabled, so it is also the way back in if RDP breaks.
Running the scripts
Always synchronous, isBackground: false, timeout: 0. Provisioning steps
run minutes. Never background them, never poll.
Check the exit code.05-verify.ps1 exits 1 when the demo is not at Beat 1.
Every step is idempotent. If step 4 fails, fix it and run .\setup-all.ps1 -From 4.
If the terminal starts mangling chained commands, switch to execution_subagent.
First build on a new machine
cd presentations/dataconus2026/whyazurebest/demos/demo3_controlplane
.\setup-all.ps1
Steps 1–6: network → VM → RDP rule → Entra-only server + Hyperscale DB → ODBC
prerequisites → pre-flight.
Two things need a human:
Step 2 prompts for the VM local administrator password. The presenter types
it straight into the terminal. Never collect it with a question tool, never
echo it, never put it in a script or a variable you print.
sqlsim.exe must be dragged over RDP into C:\demo — too big for
run-command. setup-all.ps1 pauses and prints the exact source path. Push the
other three files first with .\push-vmkit.ps1, then finish with
.\setup-all.ps1 -From 6.
Done when 05-verify.ps1 prints 17/17 PASS and "Demo is in its Beat 1 state".
Renaming or moving to another region
Both are edits to 00-config.ps1 — and to vmkit/config.ps1.
push-vmkit.ps1 copies vmkit/config.ps1verbatim; it is not generated from
00-config.ps1. The FQDN and database name are therefore written down twice and
nothing enforces that they match.
This has already broken the demo once. After a re-region the VM-side file still
named the deleted server. Every laptop script and all 17 checks passed while
query.ps1 on the VM pointed at a server that no longer existed.
Order of work:
Validate the target region has capacity for Standard_E2s_v5 before touching
anything — az vm list-skus --location <region> --size Standard_E2s_v5 and check
restrictions is empty, plus vCPU quota for the ESv5 family.
Logical server names are globally unique DNS labels — a rename can collide.
Traps that are already settled — do not rediscover them
Trap
The rule
--external-admin-sid for a managed identity
Application (client) ID, never the object ID. The object ID creates cleanly and then every login fails. Never write an appId→objectId fallback
Entra admin assignment
Must happen at server create time. az sql server ad-admin create has no --principal-type, so it cannot declare Application
ODBC Driver 18 returns 1603
Install VC++ redist first. The MSI log says Error 1723. Never diagnose an MSI from its exit code
az ... dns-zone-group show on a missing group
Returns exit 0 and {}. Invoke-Az maps a property-less object to $null — keep that fix. Verify existence checks by side effect, not by the message
az vm run-command --scripts with a multi-line string
Silently emits nothing. Use Invoke-VmScript, which writes a temp .ps1 and passes @file
Read-Host in an agent-driven terminal
Returns empty. 99-teardown.ps1 asks for the database name, so it aborts with exit 1 and deletes nothing. The presenter must run teardown themselves
Teardown
.\99-teardown.ps1 -Confirm
Scoped on purpose: VM, NIC, disk, public IP, private endpoint, DNS zone and link,
logical server, database, VNet, nsg-demo3-client, demo3.rdp. It never deletes
the resource group — bwsqlestaterg is shared and Demo 1 counts resources in it.
Tearing down drops Demo 1's estate by one logical server and one database, so
re-check that workbook if the recording matters.
Azure policy injects NRMS-* NSGs alongside the VNet. Teardown does not remove
them and they survive as orphans (subnets: null, networkInterfaces: null).
They are harmless. Confirm they are unassociated before proposing deletion, and
ask first — the resource group is shared.
Before you change shared state
Provisioning is fine to do. Do not, without asking:
re-run a beat script that locks the server down, or leave
publicNetworkAccess=Disabled behind after an investigation
delete anything in bwsqlestaterg that this kit did not create
re-measure by mutating the live environment when the presenter is rehearsing
