Merge branch 'main' into testauthinit

Author: pamelafox

app/backend/requirements.txt

@@ -190,7 +190,7 @@ microsoft-kiota-serialization-multipart==1.9.3
     # via msgraph-sdk
 microsoft-kiota-serialization-text==1.9.3
     # via msgraph-sdk
-msal==1.30.0
+msal==1.33.0
     # via
     #   -r requirements.in
     #   azure-identity

docs/azure_container_apps.md

@@ -46,7 +46,7 @@ To deploy to Azure Container Apps, please follow the following steps:
 The default workload profile is Consumption. If you want to use a dedicated workload profile like D4, please run:
 
 ```bash
-azd env AZURE_CONTAINER_APPS_WORKLOAD_PROFILE D4
+azd env set AZURE_CONTAINER_APPS_WORKLOAD_PROFILE D4
 ```
 
 For a full list of workload profiles, please check [the workload profile documentation](https://learn.microsoft.com/azure/container-apps/workload-profiles-overview#profile-types).

infra/core/networking/private-endpoint.bicep

@@ -47,7 +47,7 @@ resource privateEndpoint 'Microsoft.Network/privateEndpoints@2021-02-01' = {
     properties: {
       privateDnsZoneConfigs: !empty(dnsZoneId) ? [
         {
-          name: 'config1'
+          name: 'config-${name}-${dnsZoneId}'
           properties: {
             privateDnsZoneId: dnsZoneId
           }

infra/main.bicep

@@ -1212,8 +1212,9 @@ var cognitiveServicesPrivateEndpointConnection = (usePrivateEndpoint && (!useLoc
       {
         groupId: 'account'
         dnsZoneName: 'privatelink.cognitiveservices.azure.com'
+        // Only include generic Cognitive Services-based resources (Form Recognizer / Vision / Content Understanding)
+        // Azure OpenAI uses its own privatelink.openai.azure.com zone and already has a separate private endpoint above.
         resourceIds: concat(
-          [openAi.outputs.resourceId],
           !useLocalPdfParser ? [documentIntelligence.outputs.resourceId] : [],
           useMultimodal ? [vision.outputs.resourceId] : [],
           useMediaDescriberAzureCU ? [contentUnderstanding.outputs.resourceId] : []

infra/private-endpoints.bicep

@@ -52,8 +52,9 @@ var privateEndpointInfo = [
     resourceId: resourceId
   })
 ]
-module privateEndpoints './core/networking/private-endpoint.bicep' = [for privateEndpointInfo in flatten(privateEndpointInfo): {
-  name: '${privateEndpointInfo.name}-privateendpoint'
+
+module privateEndpoints './core/networking/private-endpoint.bicep' = [for (privateEndpointInfo, i) in flatten(privateEndpointInfo): {
+  name: '${privateEndpointInfo.name}-${i}-privateendpoint'
   params: {
     location: location
     name: '${privateEndpointInfo.name}${abbrs.privateEndpoint}${resourceToken}'
@@ -82,6 +83,7 @@ module monitorDnsZones './core/networking/private-dns-zones.bicep' = [for monito
     virtualNetworkName: vnetName
   }
 }]
+
 // Get blob DNS zone index for monitor private link
 var blobEndpointInfo = filter(flatten(privateEndpointInfo), info => info.groupId == 'blob')
 // Assert that blob endpoints exist (required for this application)