Solution: TacitRed Defender Threat Intelligence v3.0.1 - Fix Content Hub Deployment

[mazamizo21]

Summary

Fixes two deployment failures when installing the TacitRed Defender Threat Intelligence solution from Content Hub.

Problem 1: Missing Function App Code

The functionCode.zip was accidentally removed from the Package folder during a folder restructure (commit 4c731dd). The Function App template references this zip via WEBSITE_RUN_FROM_PACKAGE, so the deployed Function App had no code.

Problem 2: Template Validation Error

The Function App template included workspace-scoped Microsoft.Authorization/roleAssignments resources. When deployed through Content Hub's template spec mechanism, these cause an ARM InvalidTemplate error:

The language expression resourceId('Microsoft.OperationalInsights/Workspaces', '...') 
is not valid: the string character '@' at position '4' is not expected.

No other Function App solution in this repo uses workspace-scoped roleAssignments (verified against Fortinet, Zscaler, AWS, DomainTools). Role assignments are now documented as post-deployment steps.

Fix

• Restored functionCode.zip to Package/ folder
• Removed both Microsoft.Authorization/roleAssignments from Function App template
• Added post-deployment instructions for manual role assignment (Reader + Sentinel Contributor)
• Version bump to 3.0.1

Files Changed

File	Change
azuredeploy.json (FunctionApp)	Removed roleAssignments, updated post-deployment docs
mainTemplate.json	Removed roleAssignments from embedded template, version bump
Solution_*.json	Version bump to 3.0.1
functionCode.zip	Restored (was accidentally deleted)
3.0.1.zip	New package (replaces 3.0.0)

References

• Predecessor: PR Solution: TacitRed Defender Threat Intelligence (Official) #13266 (v3.0.0, merged)
• Pattern reference: Fortinet FortiGate Function App (no roleAssignments, inline code)

[v-maheshbh]

Hi @mazamizo21

Kindly schedule a call to discuss the PR changes in more detail. The email is included below for your reference.
v-maheshbh@microsoft.com

Thanks!

[v-maheshbh]

Hi @mazamizo21

We are encountering a deployment error during the Azure Function custom deployment.
will it be resolved after the merge using the correct functionCode ZIP file?

Thanks!

[mazamizo21]

The error is exactly what our PR #13604 fixes.* The ⁠ InvalidTemplate ⁠ error comes from the ⁠ roleAssignments ⁠ resources that had workspace-scoped ⁠ resourceId() ⁠ calls:

"scope": "[[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]"

When Content Hub deploys this through its template spec mechanism, the ARM expression parser chokes on certain characters in the workspace name (the ⁠ @ ⁠ or other special chars). The reviewer "v-amol" likely entered a workspace name that triggered the same class of parsing failure.

Our PR already removes both ⁠ roleAssignments ⁠ blocks and moves them to post-deployment manual steps — which is the standard pattern used by Fortinet, Zscaler, and every other Function App solution in the repo.