Validation Testing Checklist
Run this after every deployment and every new tenant onboarding.
| # | Test | Expected result |
|---|---|---|
| 1 | GET /api/health | {"status":"ok", ...}, HTTP 200 |
| 2 | Login — MSP/home account | Sign in with an MSP admin account → dashboard loads |
| 3 | Login — customer account | Customer user signs in with their own account; one-time consent prompt; sees only their own tenant once RBAC is assigned |
| 4 | Non-onboarded tenant rejected | A user from a tenant that hasn't been onboarded gets a clear rejection ("Sign-in tenant not onboarded"), not a generic error |
| 5 | Graph connectivity | The tenant Dashboard shows live counts, with no 502/403 |
| 6 | Device retrieval | Devices page lists managed devices |
| 7 | Intune retrieval | Compliance and configuration-profile pages populate |
| 8 | Autopilot retrieval | Autopilot page lists identities, or shows a clean "not configured" state |
| 9 | Expiry Alerts | APNs/VPP/DEP expiries show, or a clean empty state if Apple management isn't configured |
| 10 | RBAC enforcement | A Service Desk-scoped user can view but not perform destructive actions; permission errors name the exact missing permission (e.g. Missing 'Apps.View') |
| 11 | Frontend access | The SPA is served over HTTPS from the portal URL with no console CSP errors |
| 12 | API access control | Authenticated calls succeed; unauthenticated calls return 401 |
| 13 | Write action (if enabled) | Run Device Sync on a test device → success message, and a row appears in the device's Action history |
If any test fails, go to Troubleshooting — the symptoms in this checklist map directly to entries there.