I used AI tools to help draft and edit this post. I checked the facts and the wording, and the original lives at geekindata.com . The diagrams are on that page.

Stage the plane, not the env file

Key takeaways

Treat POC and MVP as different architectures, not renamed .env folders.

Draw ingress and egress as separate boxes; private endpoint is not VNet integration.

Inventory private DNS zones and which VNets they link to before you call it private.

Harden Entra (managed identity, app roles, Conditional Access) when the network hardens.

Move secrets to Key Vault references over private networking; do not promote POC placeholders.

Let networking and identity gate the stage label; configuration files follow.

A public POC proves the product loop. A private MVP proves you can survive locked-down networking.

Those are different architectures. Do not fake the second by adding more env files.

POC optimizes for learning the agent loop.…