feat: Add cross-subscription DNS zone support to 15-private-network-standard-agent-setup (#503)

- Added dnsZonesSubscriptionId parameter to allow DNS zones from different subscriptions
- Updated all DNS zone references in private-endpoint-and-dns.bicep to support cross-subscription scope
- Added comprehensive documentation in README.md about cross-subscription requirements
- Updated main.bicepparam with clear usage examples and warnings
- Maintains backward compatibility (empty parameter uses current subscription)

This enables users to reference existing private DNS zones located in a different Azure subscription than the deployment subscription, which is useful in enterprise environments with centralized DNS management.

Author: geabdluca

infrastructure/infrastructure-setup-bicep/15-private-network-standard-agent-setup/README.md

@@ -117,6 +117,7 @@ To use an existing VNet and subnets, set the existingVnetResourceId parameter to
 - param agentSubnetPrefix string = '192.168.0.0/24' //optional, default is '192.168.0.0/24'
 - param peSubnetName string = 'pe-subnet' //optional, default is 'pe-subnet'
 - param peSubnetPrefix string = '192.168.1.0/24' //optional, default is '192.168.1.0/24'
+- param dnsZonesSubscriptionId string = '' //optional, leave empty to use current subscription, or set to a subscription ID if DNS zones are in a different subscription
 - param existingDnsZones = {
 
          'privatelink.services.ai.azure.com': 'privzoneRG' //add resource group name where your private DNS zone is located
@@ -125,6 +126,10 @@ To use an existing VNet and subnets, set the existingVnetResourceId parameter to
 
 💡 If subnets information is provided then make sure it exist within the specified VNet to avoid deployment errors. If subnet information is not provided, the template will create subnets with the default address space.
 
+💡 **Cross-Subscription DNS Zones**: All DNS zones specified in `existingDnsZones` will be referenced from the subscription specified in `dnsZonesSubscriptionId`. Leave this parameter empty (default) to use the current deployment subscription, or set it to a subscription ID if your DNS zones are located in a different subscription.
+
+⚠️ **Important**: When `dnsZonesSubscriptionId` is set to a different subscription, ALL DNS zones in `existingDnsZones` must have resource groups specified (non-empty values). The template does not support creating new DNS zones in a different subscription. Empty resource groups are only allowed when creating zones in the current deployment subscription.
+
 
 2. **Use an existing Azure Cosmos DB for NoSQL**
 

infrastructure/infrastructure-setup-bicep/15-private-network-standard-agent-setup/main.bicep

@@ -95,6 +95,9 @@ param azureCosmosDBAccountResourceId string = ''
 //@description('Optional: Resource group containing existing private DNS zones. If specified, DNS zones will not be created.')
 //param existingDnsZonesResourceGroup string = ''
 
+@description('Subscription ID where existing private DNS zones are located. Leave empty to use current subscription.')
+param dnsZonesSubscriptionId string = ''
+
 @description('Object mapping DNS zone names to their resource group, or empty string to indicate creation')
 param existingDnsZones object = {
   'privatelink.services.ai.azure.com': ''
@@ -146,6 +149,9 @@ var vnetResourceGroupName = existingVnetPassedIn ? vnetParts[4] : resourceGroup(
 var existingVnetName = existingVnetPassedIn ? last(vnetParts) : vnetName
 var trimVnetName = trim(existingVnetName)
 
+// Resolve DNS zones subscription ID - use current subscription if not specified
+var resolvedDnsZonesSubscriptionId = empty(dnsZonesSubscriptionId) ? subscription().subscriptionId : dnsZonesSubscriptionId
+
 @description('The name of the project capability host to be created')
 param projectCapHost string = 'caphostproj'
 
@@ -196,6 +202,7 @@ module validateExistingResources 'modules-network-secured/validate-existing-reso
     azureCosmosDBAccountResourceId: azureCosmosDBAccountResourceId
     existingDnsZones: existingDnsZones
     dnsZoneNames: dnsZoneNames
+    dnsZonesSubscriptionId: resolvedDnsZonesSubscriptionId
   }
 }
 
@@ -264,6 +271,7 @@ module privateEndpointAndDNS 'modules-network-secured/private-endpoint-and-dns.b
       storageAccountResourceGroupName: azureStorageResourceGroupName // Resource Group for Storage Account
       storageAccountSubscriptionId: azureStorageSubscriptionId // Subscription ID for Storage Account
       existingDnsZones: existingDnsZones
+      dnsZonesSubscriptionId: resolvedDnsZonesSubscriptionId
     }
     dependsOn: [
     aiSearch      // Ensure AI Search exists

infrastructure/infrastructure-setup-bicep/15-private-network-standard-agent-setup/main.bicepparam

@@ -1,10 +1,10 @@
 using './main.bicep'
 
-param location = 'eastus2'
-param aiServices = 'aiservices'
-param modelName = 'gpt-4o'
+param location = 'westus'
+param aiServices = 'foundry'
+param modelName = 'gpt-4.1'
 param modelFormat = 'OpenAI'
-param modelVersion = '2024-11-20'
+param modelVersion = '2025-04-14'
 param modelSkuName = 'GlobalStandard'
 param modelCapacity = 30
 param firstProjectName = 'project'
@@ -20,8 +20,13 @@ param agentSubnetName = 'agent-subnet'
 param aiSearchResourceId = ''
 param azureStorageAccountResourceId = ''
 param azureCosmosDBAccountResourceId = ''
-// Pass the DNS zone map here
-// Leave empty to create new DNS zone, add the resource group of existing DNS zone to use it
+
+// Subscription ID where DNS zones are located (leave empty to use deployment subscription)
+// ⚠️ If set to a different subscription, ALL zones below MUST have resource groups specified
+param dnsZonesSubscriptionId = ''
+
+// DNS zone map: provide resource group name to use existing zone, or leave empty to create new
+// Note: Empty values only allowed when dnsZonesSubscriptionId is empty or matches current subscription
 param existingDnsZones = {
   'privatelink.services.ai.azure.com': ''
   'privatelink.openai.azure.com': ''

infrastructure/infrastructure-setup-bicep/15-private-network-standard-agent-setup/modules-network-secured/private-endpoint-and-dns.bicep

@@ -72,6 +72,9 @@ param existingDnsZones object = {
   'privatelink.documents.azure.com': ''
 }
 
+@description('Subscription ID where existing private DNS zones are located. Should be resolved to current subscription if empty.')
+param dnsZonesSubscriptionId string
+
 // ---- Resource references ----
 resource aiAccount 'Microsoft.CognitiveServices/accounts@2023-05-01' existing = {
   name: aiAccountName
@@ -221,7 +224,7 @@ resource aiServicesPrivateDnsZone 'Microsoft.Network/privateDnsZones@2020-06-01'
 // Reference existing private DNS zone if provided
 resource existingAiServicesPrivateDnsZone 'Microsoft.Network/privateDnsZones@2020-06-01' existing = if (!empty(aiServicesDnsZoneRG)) {
   name: aiServicesDnsZoneName
-  scope: resourceGroup(aiServicesDnsZoneRG)
+  scope: resourceGroup(dnsZonesSubscriptionId, aiServicesDnsZoneRG)
 }
 //creating condition if user pass existing dns zones or not
 var aiServicesDnsZoneId = empty(aiServicesDnsZoneRG) ? aiServicesPrivateDnsZone.id : existingAiServicesPrivateDnsZone.id
@@ -234,7 +237,7 @@ resource openAiPrivateDnsZone 'Microsoft.Network/privateDnsZones@2020-06-01' = i
 // Reference existing private DNS zone if provided
 resource existingOpenAiPrivateDnsZone 'Microsoft.Network/privateDnsZones@2020-06-01' existing = if (!empty(openAiDnsZoneRG)) {
   name: openAiDnsZoneName
-  scope: resourceGroup(openAiDnsZoneRG)
+  scope: resourceGroup(dnsZonesSubscriptionId, openAiDnsZoneRG)
 }
 //creating condition if user pass existing dns zones or not
 var openAiDnsZoneId = empty(openAiDnsZoneRG) ? openAiPrivateDnsZone.id : existingOpenAiPrivateDnsZone.id
@@ -247,7 +250,7 @@ resource cognitiveServicesPrivateDnsZone 'Microsoft.Network/privateDnsZones@2020
 // Reference existing private DNS zone if provided
 resource existingCognitiveServicesPrivateDnsZone 'Microsoft.Network/privateDnsZones@2020-06-01' existing = if (!empty(cognitiveServicesDnsZoneRG)) {
   name: cognitiveServicesDnsZoneName
-  scope: resourceGroup(cognitiveServicesDnsZoneRG)
+  scope: resourceGroup(dnsZonesSubscriptionId, cognitiveServicesDnsZoneRG)
 }
 //creating condition if user pass existing dns zones or not
 var cognitiveServicesDnsZoneId = empty(cognitiveServicesDnsZoneRG) ? cognitiveServicesPrivateDnsZone.id : existingCognitiveServicesPrivateDnsZone.id
@@ -260,7 +263,7 @@ resource aiSearchPrivateDnsZone 'Microsoft.Network/privateDnsZones@2020-06-01' =
 // Reference existing private DNS zone if provided
 resource existingAiSearchPrivateDnsZone 'Microsoft.Network/privateDnsZones@2020-06-01' existing = if (!empty(aiSearchDnsZoneRG)) {
   name: aiSearchDnsZoneName
-  scope: resourceGroup(aiSearchDnsZoneRG)
+  scope: resourceGroup(dnsZonesSubscriptionId, aiSearchDnsZoneRG)
 }
 //creating condition if user pass existing dns zones or not
 var aiSearchDnsZoneId = empty(aiSearchDnsZoneRG) ? aiSearchPrivateDnsZone.id : existingAiSearchPrivateDnsZone.id
@@ -273,7 +276,7 @@ resource storagePrivateDnsZone 'Microsoft.Network/privateDnsZones@2020-06-01' =
 // Reference existing private DNS zone if provided
 resource existingStoragePrivateDnsZone 'Microsoft.Network/privateDnsZones@2020-06-01' existing = if (!empty(storageDnsZoneRG)) {
   name: storageDnsZoneName
-  scope: resourceGroup(storageDnsZoneRG)
+  scope: resourceGroup(dnsZonesSubscriptionId, storageDnsZoneRG)
 }
 //creating condition if user pass existing dns zones or not
 var storageDnsZoneId = empty(storageDnsZoneRG) ? storagePrivateDnsZone.id : existingStoragePrivateDnsZone.id
@@ -286,7 +289,7 @@ resource cosmosDBPrivateDnsZone 'Microsoft.Network/privateDnsZones@2020-06-01' =
 // Reference existing private DNS zone if provided
 resource existingCosmosDBPrivateDnsZone 'Microsoft.Network/privateDnsZones@2020-06-01' existing = if (!empty(cosmosDBDnsZoneRG)) {
   name: cosmosDBDnsZoneName
-  scope: resourceGroup(cosmosDBDnsZoneRG)
+  scope: resourceGroup(dnsZonesSubscriptionId, cosmosDBDnsZoneRG)
 }
 //creating condition if user pass existing dns zones or not
 var cosmosDBDnsZoneId = empty(cosmosDBDnsZoneRG) ? cosmosDBPrivateDnsZone.id : existingCosmosDBPrivateDnsZone.id

infrastructure/infrastructure-setup-bicep/15-private-network-standard-agent-setup/modules-network-secured/validate-existing-resources.bicep

@@ -64,6 +64,9 @@ output azureStorageResourceGroupName string = azureStorageResourceGroupName
 @description('Object mapping DNS zone names to their resource group, or empty string to indicate creation')
 param existingDnsZones object
 
+@description('Subscription ID where existing private DNS zones are located. Should be resolved to current subscription if empty.')
+param dnsZonesSubscriptionId string
+
 @description('List of private DNS zone names to validate')
 param dnsZoneNames array