CreateUIDefinition-managementgroups.json

{
  "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#",
  "handler": "Microsoft.Azure.CreateUIDef",
  "version": "0.1.2-preview",
  "parameters": {
    "config": {
      "isWizard": true
    },
    "basics": [
      {
        "name": "location",
        "type": "Microsoft.Common.TextBox",
        "label": "Location",
        "defaultValue": "westus2",
        "toolTip": "Resources location",
        "visible": false
      },
      {
        "name": "infoServicePrincipal",
        "type": "Microsoft.Common.InfoBox",
        "visible": true,
        "options": {
          "icon": "Info",
          "text": "The selection of management group below defines the subscriptions Firefly will monitor. Any subscriptions within the selected scope, including any subscriptions created in the future, will be automatically discovered and monitored by Firefly. You must have the <b>owner</b> role in the Management Group selected.\n\nThe selection of subscription and resource group defines where the deployment script will be created. It has no impact on which subscriptions will be monitored by Firefly."
        }
      },
      {
        "name": "armio",
        "type": "Microsoft.Solutions.ArmApiControl",
        "request": {
          "method": "POST",
          "path": "/providers/Microsoft.Management/getEntities?api-version=2020-05-01&$skiptoken="
        }
      },
      {
        "name": "managementGroupId",
        "type": "Microsoft.Common.DropDown",
        "label": "Management Group",
        "toolTip": "Select the management group to monitor. All subscriptions under this management group will be automatically discovered and monitored by Firefly.",
        "filterPlaceholder": "Select management group scope",
        "filter": true,
        "multiselect": false,
        "selectAll": false,
        "defaultValue": "[map(filter(steps('basics').armio.value,(i) => equals(i.type,'Microsoft.Management/managementGroups')),(item) => item.properties.displayName)]",
        "constraints": {
          "allowedValues": "[map(filter(steps('basics').armio.value,(i)=> equals(i.type, 'Microsoft.Management/managementGroups')), (item)=> parse(concat('{\"label\":\"', item.properties.displayName, '\",\"value\":\"', item.name, '\"}')))]",
          "required": true
        },
        "visible": true
      },
      {
        "name": "subscriptionForDeployment",
        "type": "Microsoft.Common.DropDown",
        "label": "Subscription",
        "toolTip": "Subscription to run the deployment on",
        "filterPlaceholder": "Select subscription to run the deployment script on",
        "filter": true,
        "multiselect": false,
        "selectAll": false,
        "defaultValue": "[map(filter(steps('basics').armio.value,(i) => and(not(equals(i.type,'Microsoft.Management/managementGroups')),not(and(equals(i.properties.permissions,'noaccess'),equals(i.properties.inheritedPermissions,'noaccess'))))),(item) => item.properties.displayName)]",
        "constraints": {
          "allowedValues": "[map(filter(steps('basics').armio.value,(i)=>and(not(equals(i.type, 'Microsoft.Management/managementGroups')),not(and(equals(i.properties.permissions, 'noaccess'),equals(i.properties.inheritedPermissions, 'noaccess')))  )), (item)=> parse(concat('{\"label\":\"', item.properties.displayName, '\",\"value\":\"', item.name, '\"}')))]",
          "required": true
        },
        "visible": true
      },
      {
        "name": "armrg",
        "type": "Microsoft.Solutions.ArmApiControl",
        "request": {
          "method": "GET",
          "path": "[concat('/subscriptions/',basics('subscriptionForDeployment'),'/resourceGroups?api-version=2019-05-01')]"
        }
      },
      {
        "name": "resourceGroupOption",
        "type": "Microsoft.Common.OptionsGroup",
        "label": "Resource Group",
        "toolTip": "Choose whether to create a new resource group or use an existing one for deployment resources",
        "defaultValue": "Create new",
        "constraints": {
          "allowedValues": [
            {
              "label": "Create new",
              "value": "new"
            },
            {
              "label": "Use existing",
              "value": "existing"
            }
          ],
          "required": true
        },
        "visible": true
      },
      {
        "name": "resourceGroupInfo",
        "type": "Microsoft.Common.InfoBox",
        "visible": "[equals(basics('resourceGroupOption'), 'new')]",
        "options": {
          "icon": "Info",
          "text": "A new resource group will be created with the name 'firefly-monitoring-mg-{management-group-id}'. This resource group will contain the deployment scripts and any event-driven monitoring resources if enabled."
        }
      },
      {
        "name": "resourceGroupForDeployment",
        "type": "Microsoft.Common.DropDown",
        "label": "Existing Resource Group",
        "toolTip": "Select an existing resource group to run the deployment on",
        "filterPlaceholder": "Select resourceGroup to run the deployment script on",
        "filter": true,
        "multiselect": false,
        "selectAll": false,
        "defaultValue": "[map(basics('armrg').value, (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]",
        "constraints": {
          "allowedValues": "[map(basics('armrg').value, (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]",
          "required": "[equals(basics('resourceGroupOption'), 'existing')]"
        },
        "visible": "[equals(basics('resourceGroupOption'), 'existing')]"
      }
    ],
    "steps": [
      {
        "name": "integrationConfig",
        "type": "Microsoft.Common.Section",
        "label": "Integration Configuration",
        "elements": [
          {
            "name": "fireflySite",
            "type": "Microsoft.Common.DropDown",
            "label": "Firefly Site",
            "defaultValue": "US",
            "toolTip": "The Firefly site for your organization. Choose EU if your Firefly account is hosted in the European region.",
            "constraints": {
              "allowedValues": [
                {
                  "label": "US",
                  "value": "firefly.ai"
                },
                {
                  "label": "EU",
                  "value": "eu.firefly.ai"
                }
              ],
              "required": true
            },
            "visible": true
          },
          {
            "name": "directoryDomain",
            "type": "Microsoft.Common.TextBox",
            "label": "Directory Domain",
            "toolTip": "Enter the directory domain for Firefly integration (e.g., yourcompany.com).",
            "placeholder": "yourcompany.com",
            "constraints": {
              "required": true,
              "regex": "^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$",
              "validationMessage": "Please enter a valid domain name (e.g., example.com)"
            },
            "visible": true
          },
          {
            "name": "isProd",
            "type": "Microsoft.Common.CheckBox",
            "label": "Production Environment",
            "toolTip": "Check if this is a production environment.",
            "constraints": {
              "required": false
            },
            "visible": true
          },
          {
            "name": "enforceStorageNetworkRules",
            "type": "Microsoft.Common.CheckBox",
            "label": "Enforce Storage Network Rules",
            "toolTip": "Restrict storage account access to Firefly IP addresses only. When enabled, the storage account will only allow access from predefined Firefly IP addresses.",
            "constraints": {
              "required": false
            },
            "visible": true
          },
          {
            "name": "tags",
            "type": "Microsoft.Common.EditableGrid",
            "ariaLabel": "Custom tags for resources",
            "label": "Tags",
            "toolTip": "Add custom tags for your resources. A 'firefly: true' tag will be automatically added.",
            "constraints": {
              "width": "Full",
              "rows": {
                "count": {
                  "min": 0,
                  "max": 20
                }
              },
              "columns": [
                {
                  "id": "tagName",
                  "header": "Tag Name",
                  "width": "1fr",
                  "element": {
                    "type": "Microsoft.Common.TextBox",
                    "placeholder": "Environment",
                    "constraints": {
                      "required": true,
                      "regex": "^[a-zA-Z0-9_-]+$",
                      "validationMessage": "Tag name must contain only letters, numbers, underscores, and hyphens"
                    }
                  }
                },
                {
                  "id": "tagValue",
                  "header": "Tag Value", 
                  "width": "1fr",
                  "element": {
                    "type": "Microsoft.Common.TextBox",
                    "placeholder": "Production",
                    "constraints": {
                      "required": true,
                      "regex": "^[a-zA-Z0-9_\\s-]+$",
                      "validationMessage": "Tag value must contain only letters, numbers, spaces, underscores, and hyphens"
                    }
                  }
                }
              ]
            },
            "visible": true
          },
          {
            "name": "managementGroupInfo",
            "type": "Microsoft.Common.InfoBox",
            "visible": true,
            "options": {
              "icon": "Info",
              "text": "Management group deployment will automatically discover and integrate all subscriptions within the selected management group scope. This includes existing subscriptions and any subscriptions created in the future. The service principal will be granted the same permissions across all discovered subscriptions."
            }
          }
        ]
      },
      {
        "name": "servicePrincipal",
        "label": "Service Principal",
        "elements": [
          {
            "name": "createAppReg",
            "type": "Microsoft.Common.Section",
            "label": "Create Firefly Azure Integration",
            "elements": [
              {
                "name": "infoBox",
                "type": "Microsoft.Common.InfoBox",
                "visible": true,
                "options": {
                  "icon": "Info",
                  "text": "The following steps involve creating or selecting a service principal for Firefly to access your Azure subscriptions. Please read them carefully before continuing.\n\n1. Select the option to create a new app registration, and click 'Change Selection'.\n2. Give it a name (e.g., 'Firefly-Integration-MG') and select any account type.\n3. Click 'Register'. This will open a new page to create a client secret.\n4. Click '+ New Client Secret' to add a Client Secret.\n5. Copy the Value of the Client Secret.\n6. Click the close (X) button in the top-right corner to return to this template screen.\n7. Paste the value of the Client Secret in the corresponding field on this template.\n\nAfter deployment, this service principal will be granted the following permissions on the selected management group:\n• Reader\n• Billing Reader\n• App Configuration Data Reader\n• Security Reader\n• Monitoring Reader\n\nAdditionally, custom roles will be created in the deployment subscription for accessing storage accounts and other Azure services."
                }
              },
              {
                "name": "ServicePrincipal",
                "type": "Microsoft.Common.ServicePrincipalSelector",
                "label": {
                  "servicePrincipalId": "Service Principal Id",
                  "password": "Client Secret",
                  "sectionHeader": "Service Principal"
                },
                "toolTip": {
                  "servicePrincipalId": "Service Principal for Firefly integration"
                },
                "defaultValue": {
                  "principalId": "<default guid>",
                  "name": "(New) default App Id"
                },
                "constraints": {
                  "required": true,
                  "validationMessage": "Must be a valid client secret"
                },
                "options": {
                  "hideCertificate": true
                },
                "visible": true
              }
            ],
            "visible": true
          }
        ]
      },
      {
        "name": "fireflyCredentials",
        "label": "Firefly Credentials",
        "elements": [
          {
            "name": "ffAccessKey",
            "type": "Microsoft.Common.PasswordBox",
            "label": {
                "password": "Firefly Access Key",
                "confirmPassword": "Re-enter Firefly Access Key"
            },
            "toolTip": "Enter your Firefly Access Key.",
            "constraints": { 
              "required": true,
              "regex": "^.+$",
              "validationMessage": "Firefly Access Key is required"
            },
            "options": {
              "hideConfirmation": true
            }
          },
          {
            "name": "ffSecretKey",
            "type": "Microsoft.Common.PasswordBox",
            "label": {
                "password": "Firefly Secret Key",
                "confirmPassword": "Re-enter Firefly Secret Key"
            },
            "toolTip": "Enter your Firefly Secret Key.",
            "constraints": { 
              "required": true,
              "regex": "^.+$",
              "validationMessage": "Firefly Secret Key is required"
            },
            "options": {
              "hideConfirmation": true
            }
          }
        ]
      }
    ],
    "outputs": {
      "location": "[basics('location')]",
      "managementGroupId": "[basics('managementGroupId')]",
      "subscriptionIdForDeployment": "[basics('subscriptionForDeployment')]",
      "servicePrincipalClientId": "[steps('servicePrincipal').createAppReg.ServicePrincipal.appId]",
      "servicePrincipalObjectId": "[first(steps('servicePrincipal').createAppReg.ServicePrincipal.objectId)]",
      "servicePrincipalClientSecret": "[steps('servicePrincipal').createAppReg.ServicePrincipal.password]",
      "fireflyAccessKey": "[steps('fireflyCredentials').ffAccessKey]",
      "fireflySecretKey": "[steps('fireflyCredentials').ffSecretKey]",
      "fireflySite": "[steps('integrationConfig').fireflySite]",
      "directoryDomain": "[steps('integrationConfig').directoryDomain]",
      "isProd": "[steps('integrationConfig').isProd]",
      "enforceStorageNetworkRules": "[steps('integrationConfig').enforceStorageNetworkRules]",
      "tags": "[steps('integrationConfig').tags]"
    }
  }
}