Teammeeting with Mike Martin
We had the pleasure of welcoming Mike Martin to our office, where he presented his talk, “ "1, 2, 3, … Testing, Is This Thing On(line)?” or in the dialect of Antwerp: "iejn, twiej, drei, Test, test".
His core message came down to one phrase: Failure Is No Option.
Testing the whole solution from start to finish, rather than focusing on the code alone, is what gives you confidence in your product, deployment, and real-world user experience.
Mike Martin presented a couple of tools to us which can help us achieve this. Even though the demo gods were not on his side, he managed to keep us engaged throughout his two-hour presentation. He took us into the world of testing with a fun theatre reference, making the topic both relatable and entertaining.
Playwright
Playwright has grown into more than a browser automation library. It provides cross-browser testing, API testing, debugging, reporting, and CI/CD integration in a single ecosystem.
It supports C#, Python, TypeScript, and JavaScript, and some more languages. It can run tests against Chromium, WebKit, and Firefox, either headed or headless and even inside containers.
There is a VS Code extension that provides an integrated test overview, while the HTML reporter includes screenshots, videos, and trace files. The trace viewer is useful for debugging failed tests because of the possibility to replay the test step by step with screenshots and network activity.
Playwright also includes Codegen, a command-line recorder that generates test code based on browser interactions. Running npx playwright codegen http://... opens a recorder that creates locators and actions as you interact with the application. The generated code often needs some cleanup, but it is a useful starting point for both tests and documentation.
Beyond UI testing, Playwright can test APIs directly and integrates with CI/CD platforms such as GitHub Actions, Azure DevOps, and Jenkins. Azure Playwright Workspaces can extend this to larger test runs across different users and regions.
It also has MCP and CLI support for AI-assisted testing. Mike Martin gave the tip to use the MCP for planning test scenarios, while using the CLI for execution, as it uses less tokens.
ARM-TTK
For IaC (Infrastructure as Code, for example with Terraform) the same rules apply as application code. It needs versioning and testing. That’s where ARM-TTK comes in. It’s a PowerShell-based toolkit to validate ARM templates and Bicep configurations before they’re deployed. It checks things like whether API versions are pinned correctly, whether values such as locations are hardcoded instead of parameterised, and whether general best practices are followed.
The goal is simple: catch infrastructure issues early, before a deployment command ever reaches a real Azure environment.
Azure Load Testing
For performance testing, Azure Load Testing runs JMeter scripts against the deployment and returns a report packed with metrics.
The report contains raw response times and error rates, application performance with the underlying infrastructure it depends on for example database throughput, the RU consumption on Cosmos DB, CPU and memory on App Service, or messages piling up in Service Bus.
The reporting layer also gives AI-assisted insights to help explain what changed and where possible issues are.
It can fit into CI/CD pipelines, where performance thresholds can act as a gate. This makes it possible to compare results from different test runs side by side. There’s a browser extension that can generate the .jmx scripts too.
Azure Chaos Studio
To test the application's resilience there is Azure Chaos Studio. It makes it possible to deliberately introduce failures and observe how the system responds, what happens to the workload, and how recovery mechanisms perform.
It can inject failures at different levels using several preconfigured faults. For example, an Azure service failure can be simulated to trigger a Cosmos DB failover between regions. At the Kubernetes level, a pod can be terminated or network connectivity disrupted.
The purpose is to verify how a cloud-native workload responds to these failures and, most importantly, whether it can recover as expected.
This all runs on Production, but done properly, a production chaos experiment should be a non-event. If the failover, redundancy, and recovery mechanisms are configured correctly, removing or disrupting a target should not have a customer-facing impact. Nevertheless, customers should be given a heads-up before chaos testing takes place. The purpose is to validate the engineers' confidence in the architecture and its resilience mechanisms, rather than relying on blind faith that everything will work as expected.
Security Testing with PSRule for Azure
PSRule for Azure is a pre-built collection of tests and documentation designed to help configure and validate Azure solutions.
The tests can be used to validate Infrastructure as Code (IaC) before or after deployment to Azure. PSRule for Azure includes unit tests that evaluate the configuration of Azure resources defined in ARM templates or Bicep code.
By integrating these tests into the CI/CD pipeline, configuration issues can be identified early and Azure infrastructure can be validated against recommended practices.
Foundry AI Red Teaming Agent
As generative AI becomes a core part of modern applications, we need specialised security tools. The AI Red Teaming Agent helps teams proactively uncover safety and security risks in LLM models and agentic workflows.
It does Adversarial Probing which means that it automates simulated attacks (like jailbreaks, indirect prompt injections, and data leakage scans) during the design, development, and pre-deployment phases.
It also does Automated Scoring. That means it evaluates attack-response pairs to calculate an Attack Success Rate (ASR), giving engineering teams concrete metrics on whether an AI system is safe for production.
Accessibility Insights
It is very important for the applications of today to be accessible to everyone. There is a set of rules which can be used in the CI/CD to check if for example alt texts are filled in, or that the tabbing is in the correct order.
It can also be done manually with a browser extension method, that then gives a report back.
Microsoft (Graph) Developer Proxy
The Microsoft Graph Developer Proxy acts as a local proxy that simulates API behaviours. It simulates API throttling (HTTP 429), random timeouts, and authentication errors. This makes sure that the application is validated on resilience. This allows developers to rigorously test how their code handles unstable network conditions and rate limits without needing to manipulate live production configurations.
Microsoft Clarity
Microsoft Clarity is a free user behaviour analytics tool that visualizes how people interact with your live site. It contains session recordings and heatmaps. Those provide visual click maps, scroll tracking, and anonymised recordings of actual user usages. It identifies "rage clicks". That means when a user repeatedly clicks an unhelpful button or dead links. This gives the development team immediate data on where the user experience is failing.
Failure Is No Option
Mike's presentation showed that testing is much broader than checking whether a piece of code produces the expected result.
The application, APIs, infrastructure, performance, security, resilience, accessibility, and even how real users interact with the finished product can all be tested.
The conclusion is simple: don't assume it works, test it.
A massive thanks to Mike Martin for sharing his testing expertise. Now it's time to put these insights into practice, so that failure truly is no option.
Celine Vancoppenolle