From 2be752ceb5030df8050558756b55ea090912af39 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Thu, 3 Jul 2025 16:06:21 +0530
Subject: [PATCH 01/70] edit

---
 .github/workflows/deploy.yml          | 190 ++++++++++++++++++++++----
 .github/workflows/test-automation.yml |  87 ++++++++++--
 2 files changed, 234 insertions(+), 43 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 4dac8961f..52eb1bcaa 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -2,14 +2,29 @@ name: Validate Deployment
 
 on:
   push:
+  workflow_run:
+    workflows: ["Build Docker and Optional Push"]
+    types:
+      - completed
     branches:
       - main
+      - hotfix
   schedule:
-    - cron: '0 11,23 * * *'  # Runs at 11:00 AM and 11:00 PM GMT
+    - cron: "0 11,23 * * *" # Runs at 11:00 AM and 11:00 PM GMT
+  workflow_dispatch: #Allow manual triggering
+env:
+  GPT_MIN_CAPACITY: 250
+  TEXT_EMBEDDING_MIN_CAPACITY: 90
+  BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
 
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    outputs:
+      RESOURCE_GROUP_NAME: ${{ steps.check_create_rg.outputs.RESOURCE_GROUP_NAME }}
+      WEBAPP_URL: ${{ steps.get_output.outputs.WEBAPP_URL }}
+      DEPLOYMENT_SUCCESS: ${{ steps.deployment_status.outputs.SUCCESS }}
+      API_APP_URL: ${{ steps.get_output.outputs.API_APP_URL }}
     steps:
       - name: Checkout Code
         uses: actions/checkout@v3
@@ -55,7 +70,7 @@ jobs:
       - name: Set Deployment Region
         run: |
           echo "Selected Region: $VALID_REGION"
-          echo "AZURE_LOCATION=$VALID_REGION" >> $GITHUB_ENV 
+          echo "AZURE_LOCATION=$VALID_REGION" >> $GITHUB_ENV
 
       - name: Setup Azure CLI
         run: |
@@ -77,8 +92,7 @@ jobs:
           SHORT_UUID=$(uuidgen | cut -d'-' -f1)
           UNIQUE_RG_NAME="arg-${ACCL_NAME}-${SHORT_UUID}"
           echo "RESOURCE_GROUP_NAME=${UNIQUE_RG_NAME}" >> $GITHUB_ENV
-          echo "Generated Resource_GROUP_PREFIX: ${UNIQUE_RG_NAME}" 
-      
+          echo "Generated Resource_GROUP_PREFIX: ${UNIQUE_RG_NAME}"
 
       - name: Check and Create Resource Group
         id: check_create_rg
@@ -93,36 +107,134 @@ jobs:
             echo "Resource group already exists."
           fi
 
+      - name: Generate Unique Solution Prefix
+        id: generate_solution_prefix
+        run: |
+          set -e
+          COMMON_PART="macae"
+          TIMESTAMP=$(date +%s)  
+          UPDATED_TIMESTAMP=$(echo $TIMESTAMP | tail -c 6) 
+          UNIQUE_SOLUTION_PREFIX="${COMMON_PART}${UPDATED_TIMESTAMP}"
+          echo "SOLUTION_PREFIX=${UNIQUE_SOLUTION_PREFIX}" >> $GITHUB_ENV
+          echo "Generated SOLUTION_PREFIX: ${UNIQUE_SOLUTION_PREFIX}"
 
       - name: Deploy Bicep Template
         id: deploy
         run: |
           set -e
+          # set image tag based on branch
+          if [[ "${{ env.BRANCH_NAME }}" == "main" ]]; then
+            IMAGE_TAG="latest"
+          elif [[ "${{ env.BRANCH_NAME }}" == "hotfix" ]]; then
+            IMAGE_TAG="hotfix"
+          else
+            IMAGE_TAG="latest"
+          fi
+
           az deployment group create \
             --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
             --template-file infra/main.bicep \
-            --parameters azureOpenAILocation=${{ env.AZURE_LOCATION }}
+            --parameters \
+                environmentName=${{env.SOLUTION_PREFIX}} \
+                solutionLocation="swedencentral" \
+                azureOpenAILocation="swedencentral" \
+                modelDeploymentType="GlobalStandard" \
+                gptModelName="gpt-4o" \
+                gptModelVersion="2024-08-06" \
+                imageTag="${IMAGE_TAG}"
+
+      - name: Extract Web App and API App URLs
+        id: get_output # <-- Add this
+        run: |
+          echo "Fetching Web Apps..."
+
+          WEBAPP_NAMES=$(az webapp list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --query "[].name" -o tsv)
+          echo "Detected Web Apps: $WEBAPP_NAMES"
+          for NAME in $WEBAPP_NAMES; do
+            if [[ $NAME == app-* ]]; then
+              WEBAPP_URL="https://${NAME}.azurewebsites.net"
+              echo "WEBAPP_URL=$WEBAPP_URL" >> $GITHUB_OUTPUT
+              echo "WEBAPP_URL=$WEBAPP_URL" 
+            elif [[ $NAME == api-* ]]; then
+              API_APP_URL="https://${NAME}.azurewebsites.net"
+              echo "API_APP_URL=$API_APP_URL" >> $GITHUB_OUTPUT
+              echo "API_APP_URL=$API_APP_URL"
+            fi
+          done
 
+      - name: Extract AI Services and Key Vault Names
+        if: always()
+        run: |
+          echo "Fetching AI Services and Key Vault names before deletion..."
 
-      - name: Send Notification on Failure
-        if: failure()
+          # Get Key Vault name
+          KEYVAULT_NAME=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.KeyVault/vaults" --query "[].name" -o tsv)
+          echo "Detected Key Vault: $KEYVAULT_NAME"
+          echo "KEYVAULT_NAME=$KEYVAULT_NAME" >> $GITHUB_ENV
+
+          # Get AI Services names and convert them into a space-separated string
+          AI_SERVICES=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.CognitiveServices/accounts" --query "[].name" -o tsv | tr '\n' ' ')
+
+          echo "Detected AI Services: $AI_SERVICES"
+          echo "AI_SERVICES=$AI_SERVICES" >> $GITHUB_ENV
+
+      - name: Set Deployment Status
+        id: deployment_status
+        if: always()
         run: |
-          RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-      
-          # Construct the email body
-          EMAIL_BODY=$(cat <<EOF
-          {
-            "body": "<p>Dear Team,</p><p>We would like to inform you that the Multi-Agent-Custom-Automation-Engine-Solution-Accelerator Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Build URL:</strong> ${RUN_URL}<br> ${OUTPUT}</p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>"
-          }
-          EOF
-          )
-      
-          # Send the notification
-          curl -X POST "${{ secrets.LOGIC_APP_URL }}" \
-            -H "Content-Type: application/json" \
-            -d "$EMAIL_BODY" || echo "Failed to send notification"
-  
-    
+          if [ "${{ job.status }}" == "success" ]; then
+            echo "SUCCESS=true" >> $GITHUB_OUTPUT
+          else
+            echo "SUCCESS=false" >> $GITHUB_OUTPUT
+          fi
+      - name: Logout from Azure
+        if: always()
+        run: |
+          az logout
+          echo "Logged out from Azure."
+
+  # NEW: E2E Test Job that calls the reusable workflow
+  e2e-test:
+    needs: deploy
+    if: needs.deploy.outputs.DEPLOYMENT_SUCCESS == 'true'
+    uses: ./.github/workflows/test-automation.yml
+    with:
+      MACAE_WEB_URL: ${{ needs.deploy.outputs.WEBAPP_URL }}
+      MACAE_URL_API: ${{ needs.deploy.outputs.API_APP_URL }}
+    secrets: inherit
+  cleanup-deployment:
+    if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
+    needs: [deploy, e2e-test]
+    runs-on: ubuntu-latest
+    env:
+      RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
+    steps:
+      - name: Setup Azure CLI
+        run: |
+          curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
+          az --version
+      - name: Login to Azure
+        run: |
+          az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
+          az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
+
+      - name: Extract AI Services and Key Vault Names
+        if: always()
+        run: |
+          echo "Fetching AI Services and Key Vault names before deletion..."
+
+          # Get Key Vault name
+          KEYVAULT_NAME=$(az resource list --resource-group "${{ env.RESOURCE_GROUP_NAME }}" --resource-type "Microsoft.KeyVault/vaults" --query "[].name" -o tsv)
+          echo "Detected Key Vault: $KEYVAULT_NAME"
+          echo "KEYVAULT_NAME=$KEYVAULT_NAME" >> $GITHUB_ENV
+          # Extract AI Services names
+          echo "Fetching AI Services..."
+          AI_SERVICES=$(az resource list --resource-group '${{ env.RESOURCE_GROUP_NAME }}' --resource-type "Microsoft.CognitiveServices/accounts" --query "[].name" -o tsv)
+          # Flatten newline-separated values to space-separated
+          AI_SERVICES=$(echo "$AI_SERVICES" | paste -sd ' ' -)
+          echo "Detected AI Services: $AI_SERVICES"
+          echo "AI_SERVICES=$AI_SERVICES" >> $GITHUB_ENV
+
       - name: Get OpenAI Resource from Resource Group
         id: get_openai_resource
         run: |
@@ -130,7 +242,7 @@ jobs:
 
           set -e
           echo "Fetching OpenAI resource from resource group ${{ env.RESOURCE_GROUP_NAME }}..."
-          
+
           # Run the az resource list command to get the OpenAI resource name
           openai_resource_name=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.CognitiveServices/accounts" --query "[0].name" -o tsv)
 
@@ -142,9 +254,6 @@ jobs:
             echo "OpenAI resource name: ${openai_resource_name}" 
           fi
 
-          
-
-          
       - name: Delete Bicep Deployment
         if: always()
         run: |
@@ -162,11 +271,10 @@ jobs:
             echo "Resource group does not exists."
           fi
 
-
       - name: Wait for resource deletion to complete
         run: |
 
-          
+
           # Add resources to the array
           resources_to_check=("${{ env.OPENAI_RESOURCE_NAME }}")
 
@@ -214,7 +322,6 @@ jobs:
             fi
           done
 
-          
       - name: Purging the Resources
         if: always()
         run: |
@@ -231,3 +338,26 @@ jobs:
           fi
 
           echo "Resource purging completed successfully"
+
+      - name: Send Notification on Failure
+        if: failure()
+        run: |
+          RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
+          # Construct the email body
+          EMAIL_BODY=$(cat <<EOF
+          {
+            "body": "<p>Dear Team,</p><p>We would like to inform you that the Multi-Agent-Custom-Automation-Engine-Solution-Accelerator Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Build URL:</strong> ${RUN_URL}<br> ${OUTPUT}</p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>"
+          }
+          EOF
+          )
+
+          # Send the notification
+          curl -X POST "${{ secrets.LOGIC_APP_URL }}" \
+            -H "Content-Type: application/json" \
+            -d "$EMAIL_BODY" || echo "Failed to send notification"
+      - name: Logout from Azure
+        if: always()
+        run: |
+          az logout
+          echo "Logged out from Azure."
diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index 28e7b8098..db66cb864 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -6,28 +6,43 @@ on:
       - main
       - dev
     paths:
-      - 'tests/e2e-test/**'
+      - "tests/e2e-test/**"
   schedule:
-      - cron: '0 13 * * *'  # Runs at 1 PM UTC
+    - cron: "0 13 * * *" # Runs at 1 PM UTC
   workflow_dispatch:
 
+  workflow_call:
+    inputs:
+      MACAE_WEB_URL:
+        required: false
+        type: string
+        description: "Web URL for MACAE (overrides environment variable)"
+      MACAE_URL_API:
+        required: false
+        type: string
+        description: "API URL for MACAE (overrides environment variable)"
+    secrets:
+      EMAILNOTIFICATION_LOGICAPP_URL_TA:
+        required: false
+        description: "Logic App URL for email notifications"
+
 env:
-    url: ${{ vars.MACAE_WEB_URL }}
-    api_url: ${{ vars.MACAE_API_URL }}
-    accelerator_name: "MACAE"
+  # Use input URL if provided (from deploy pipeline), otherwise fall back to vars
+  url: ${{ inputs.MACAE_WEB_URL  }}
+  api_url: ${{ inputs.MACAE_URL_API}}
+  accelerator_name: "MACAE"
 
 jobs:
   test:
-
     runs-on: ubuntu-latest
-    steps:      
+    steps:
       - name: Checkout repository
         uses: actions/checkout@v4
 
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
-          python-version: '3.13'
+          python-version: "3.13"
 
       - name: Azure CLI Login
         uses: azure/login@v2
@@ -38,7 +53,7 @@ jobs:
         id: start-container-app
         uses: azure/cli@v2
         with:
-          azcliversion: 'latest'
+          azcliversion: "latest"
           inlineScript: |
             az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ vars.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ vars.MACAE_BACKEND_CONTAINER_NAME }}/start?api-version=2025-01-01"
 
@@ -50,6 +65,40 @@ jobs:
       - name: Ensure browsers are installed
         run: python -m playwright install --with-deps chromium
 
+      - name: Validate URL
+        run: |
+          if [ -z "${{ env.url }}" ]; then
+            echo "ERROR: No URL provided for testing"
+            exit 1
+          elif [ -z "${{ env.api_url }}" ]; then
+            echo "ERROR: No API URL provided for testing"
+            exit 1
+          fi
+          echo "Testing URL: ${{ env.url }}"
+          echo "Testing API URL: ${{ env.api_url }}"
+      - name: Wait for Application to be Ready
+        run: |
+          echo "Waiting for application to be ready at ${{ env.url }} "
+          max_attempts=10
+          attempt=1
+
+          while [ $attempt -le $max_attempts ]; do
+            echo "Attempt $attempt: Checking if application is ready..."
+            if curl -f -s "${{ env.url }}" > /dev/null; then
+              echo "Application is ready!"
+              break
+            fi
+            
+            if [ $attempt -eq $max_attempts ]; then
+              echo "Application is not ready after $max_attempts attempts"
+              exit 1
+            fi
+            
+            echo "Application not ready, waiting 30 seconds..."
+            sleep 30
+            attempt=$((attempt + 1))
+          done
+
       - name: Run tests(1)
         id: test1
         run: |
@@ -87,15 +136,27 @@ jobs:
         uses: actions/upload-artifact@v4
         if: ${{ !cancelled() }}
         with:
-          name: test-report
+          name: test-report-${{ github.run_id }}
           path: tests/e2e-test/report/*
+      - name: Determine Test Result
+        id: test_result
+        run: |
+          IS_SUCCESS=${{ steps.test1.outcome == 'success' || steps.test2.outcome == 'success' || steps.test3.outcome == 'success' }}
+          echo "IS_SUCCESS=$IS_SUCCESS" >> $GITHUB_OUTPUT
+
+          if [ "$IS_SUCCESS" = "true" ]; then
+            echo "✅ Tests passed!"
+          else
+            echo "❌ All test attempts failed"
+            exit 1
+          fi
 
       - name: Send Notification
         if: always()
         run: |
           RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
           REPORT_URL=${{ steps.upload_report.outputs.artifact-url }}
-          IS_SUCCESS=${{ steps.test1.outcome == 'success' || steps.test2.outcome == 'success' || steps.test3.outcome == 'success' }}
+          IS_SUCCESS=${{ steps.test_result.outputs.IS_SUCCESS }}
           # Construct the email body
           if [ "$IS_SUCCESS" = "true" ]; then
             EMAIL_BODY=$(cat <<EOF
@@ -124,7 +185,7 @@ jobs:
         if: always()
         uses: azure/cli@v2
         with:
-          azcliversion: 'latest'
+          azcliversion: "latest"
           inlineScript: |
             az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ vars.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ vars.MACAE_BACKEND_CONTAINER_NAME }}/stop?api-version=2025-01-01"
-            az logout
\ No newline at end of file
+            az logout

From 45b791bebb5b7b242973b0a6107ba8f94c69db13 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Thu, 3 Jul 2025 16:34:30 +0530
Subject: [PATCH 02/70] edit

---
 .github/workflows/deploy.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 52eb1bcaa..9580546c1 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -13,8 +13,7 @@ on:
     - cron: "0 11,23 * * *" # Runs at 11:00 AM and 11:00 PM GMT
   workflow_dispatch: #Allow manual triggering
 env:
-  GPT_MIN_CAPACITY: 250
-  TEXT_EMBEDDING_MIN_CAPACITY: 90
+  GPT_MIN_CAPACITY: 140
   BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
 
 jobs:

From dd878136069974d6d05674aa9b895ce40424e54a Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Fri, 4 Jul 2025 11:28:21 +0530
Subject: [PATCH 03/70] updated deploy-waf

---
 .github/workflows/deploy-waf.yml | 185 +++++++++++++++++++++++++------
 1 file changed, 154 insertions(+), 31 deletions(-)

diff --git a/.github/workflows/deploy-waf.yml b/.github/workflows/deploy-waf.yml
index b97c51d0d..9feaec793 100644
--- a/.github/workflows/deploy-waf.yml
+++ b/.github/workflows/deploy-waf.yml
@@ -1,15 +1,29 @@
-name: Validate WAF Deployment 
+name: Validate WAF Deployment
 
 on:
   push:
+  workflow_run:
+    workflows: ["Build Docker and Optional Push"]
+    types:
+      - completed
     branches:
       - main
+      - hotfix
   schedule:
-    - cron: '0 11,23 * * *'  # Runs at 11:00 AM and 11:00 PM GMT
+    - cron: "0 11,23 * * *" # Runs at 11:00 AM and 11:00 PM GMT
+  workflow_dispatch:
+env:
+  GPT_MIN_CAPACITY: 140
+  BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
 
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    outputs:
+      RESOURCE_GROUP_NAME: ${{ steps.check_create_rg.outputs.RESOURCE_GROUP_NAME }}
+      WEBAPP_URL: ${{ steps.get_output.outputs.WEBAPP_URL }}
+      DEPLOYMENT_SUCCESS: ${{ steps.deployment_status.outputs.SUCCESS }}
+      API_APP_URL: ${{ steps.get_output.outputs.API_APP_URL }}
     steps:
       - name: Checkout Code
         uses: actions/checkout@v3
@@ -55,7 +69,7 @@ jobs:
       - name: Set Deployment Region
         run: |
           echo "Selected Region: $VALID_REGION"
-          echo "AZURE_LOCATION=$VALID_REGION" >> $GITHUB_ENV 
+          echo "AZURE_LOCATION=$VALID_REGION" >> $GITHUB_ENV
 
       - name: Setup Azure CLI
         run: |
@@ -77,8 +91,7 @@ jobs:
           SHORT_UUID=$(uuidgen | cut -d'-' -f1)
           UNIQUE_RG_NAME="arg-${ACCL_NAME}-${SHORT_UUID}"
           echo "RESOURCE_GROUP_NAME=${UNIQUE_RG_NAME}" >> $GITHUB_ENV
-          echo "Generated Resource_GROUP_PREFIX: ${UNIQUE_RG_NAME}" 
-      
+          echo "Generated Resource_GROUP_PREFIX: ${UNIQUE_RG_NAME}"
 
       - name: Check and Create Resource Group
         id: check_create_rg
@@ -93,37 +106,134 @@ jobs:
             echo "Resource group already exists."
           fi
 
+      - name: Generate Unique Solution Prefix
+        id: generate_solution_prefix
+        run: |
+          set -e
+          COMMON_PART="macae"
+          TIMESTAMP=$(date +%s)  
+          UPDATED_TIMESTAMP=$(echo $TIMESTAMP | tail -c 6) 
+          UNIQUE_SOLUTION_PREFIX="${COMMON_PART}${UPDATED_TIMESTAMP}"
+          echo "SOLUTION_PREFIX=${UNIQUE_SOLUTION_PREFIX}" >> $GITHUB_ENV
+          echo "Generated SOLUTION_PREFIX: ${UNIQUE_SOLUTION_PREFIX}"
 
       - name: Deploy Bicep Template
         id: deploy
         run: |
           set -e
+          # set image tag based on branch
+          if [[ "${{ env.BRANCH_NAME }}" == "main" ]]; then
+            IMAGE_TAG="latest"
+          elif [[ "${{ env.BRANCH_NAME }}" == "hotfix" ]]; then
+            IMAGE_TAG="hotfix"
+          else
+            IMAGE_TAG="latest"
+          fi
           az deployment group create \
             --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
             --template-file infra/main.bicep \
             --parameters infra/main.waf-aligned.bicepparam \
-            --parameters azureOpenAILocation=${{ env.AZURE_LOCATION }}
+            --parameters \
+                environmentName=${{env.SOLUTION_PREFIX}} \
+                solutionLocation="swedencentral" \
+                azureOpenAILocation="swedencentral" \
+                modelDeploymentType="GlobalStandard" \
+                gptModelName="gpt-4o" \
+                gptModelVersion="2024-08-06" \
+                imageTag="${IMAGE_TAG}"
+
+      - name: Extract Web App and API App URLs
+        id: get_output # <-- Add this
+        run: |
+          echo "Fetching Web Apps..."
+
+          WEBAPP_NAMES=$(az webapp list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --query "[].name" -o tsv)
+          echo "Detected Web Apps: $WEBAPP_NAMES"
+          for NAME in $WEBAPP_NAMES; do
+            if [[ $NAME == app-* ]]; then
+              WEBAPP_URL="https://${NAME}.azurewebsites.net"
+              echo "WEBAPP_URL=$WEBAPP_URL" >> $GITHUB_OUTPUT
+              echo "WEBAPP_URL=$WEBAPP_URL" 
+            elif [[ $NAME == api-* ]]; then
+              API_APP_URL="https://${NAME}.azurewebsites.net"
+              echo "API_APP_URL=$API_APP_URL" >> $GITHUB_OUTPUT
+              echo "API_APP_URL=$API_APP_URL"
+            fi
+          done
 
+      - name: Extract AI Services and Key Vault Names
+        if: always()
+        run: |
+          echo "Fetching AI Services and Key Vault names before deletion..."
 
-      - name: Send Notification on Failure
-        if: failure()
+          # Get Key Vault name
+          KEYVAULT_NAME=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.KeyVault/vaults" --query "[].name" -o tsv)
+          echo "Detected Key Vault: $KEYVAULT_NAME"
+          echo "KEYVAULT_NAME=$KEYVAULT_NAME" >> $GITHUB_ENV
+
+          # Get AI Services names and convert them into a space-separated string
+          AI_SERVICES=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.CognitiveServices/accounts" --query "[].name" -o tsv | tr '\n' ' ')
+
+          echo "Detected AI Services: $AI_SERVICES"
+          echo "AI_SERVICES=$AI_SERVICES" >> $GITHUB_ENV
+
+      - name: Set Deployment Status
+        id: deployment_status
+        if: always()
         run: |
-          RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-      
-          # Construct the email body
-          EMAIL_BODY=$(cat <<EOF
-          {
-            "body": "<p>Dear Team,</p><p>We would like to inform you that the Multi-Agent-Custom-Automation-Engine-Solution-Accelerator Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Build URL:</strong> ${RUN_URL}<br> ${OUTPUT}</p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>"
-          }
-          EOF
-          )
-      
-          # Send the notification
-          curl -X POST "${{ secrets.LOGIC_APP_URL }}" \
-            -H "Content-Type: application/json" \
-            -d "$EMAIL_BODY" || echo "Failed to send notification"
-  
-    
+          if [ "${{ job.status }}" == "success" ]; then
+            echo "SUCCESS=true" >> $GITHUB_OUTPUT
+          else
+            echo "SUCCESS=false" >> $GITHUB_OUTPUT
+          fi
+      - name: Logout from Azure
+        if: always()
+        run: |
+          az logout
+          echo "Logged out from Azure."
+
+  # NEW: E2E Test Job that calls the reusable workflow
+  e2e-test:
+    needs: deploy
+    if: needs.deploy.outputs.DEPLOYMENT_SUCCESS == 'true'
+    uses: ./.github/workflows/test-automation.yml
+    with:
+      MACAE_WEB_URL: ${{ needs.deploy.outputs.WEBAPP_URL }}
+      MACAE_URL_API: ${{ needs.deploy.outputs.API_APP_URL }}
+    secrets: inherit
+  cleanup-deployment:
+    if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
+    needs: [deploy, e2e-test]
+    runs-on: ubuntu-latest
+    env:
+      RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
+    steps:
+      - name: Setup Azure CLI
+        run: |
+          curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
+          az --version
+      - name: Login to Azure
+        run: |
+          az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
+          az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
+
+      - name: Extract AI Services and Key Vault Names
+        if: always()
+        run: |
+          echo "Fetching AI Services and Key Vault names before deletion..."
+
+          # Get Key Vault name
+          KEYVAULT_NAME=$(az resource list --resource-group "${{ env.RESOURCE_GROUP_NAME }}" --resource-type "Microsoft.KeyVault/vaults" --query "[].name" -o tsv)
+          echo "Detected Key Vault: $KEYVAULT_NAME"
+          echo "KEYVAULT_NAME=$KEYVAULT_NAME" >> $GITHUB_ENV
+          # Extract AI Services names
+          echo "Fetching AI Services..."
+          AI_SERVICES=$(az resource list --resource-group '${{ env.RESOURCE_GROUP_NAME }}' --resource-type "Microsoft.CognitiveServices/accounts" --query "[].name" -o tsv)
+          # Flatten newline-separated values to space-separated
+          AI_SERVICES=$(echo "$AI_SERVICES" | paste -sd ' ' -)
+          echo "Detected AI Services: $AI_SERVICES"
+          echo "AI_SERVICES=$AI_SERVICES" >> $GITHUB_ENV
+
       - name: Get OpenAI Resource from Resource Group
         id: get_openai_resource
         run: |
@@ -131,7 +241,7 @@ jobs:
 
           set -e
           echo "Fetching OpenAI resource from resource group ${{ env.RESOURCE_GROUP_NAME }}..."
-          
+
           # Run the az resource list command to get the OpenAI resource name
           openai_resource_name=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.CognitiveServices/accounts" --query "[0].name" -o tsv)
 
@@ -143,9 +253,6 @@ jobs:
             echo "OpenAI resource name: ${openai_resource_name}" 
           fi
 
-          
-
-          
       - name: Delete Bicep Deployment
         if: always()
         run: |
@@ -163,11 +270,10 @@ jobs:
             echo "Resource group does not exists."
           fi
 
-
       - name: Wait for resource deletion to complete
         run: |
 
-          
+
           # Add resources to the array
           resources_to_check=("${{ env.OPENAI_RESOURCE_NAME }}")
 
@@ -215,7 +321,6 @@ jobs:
             fi
           done
 
-          
       - name: Purging the Resources
         if: always()
         run: |
@@ -232,3 +337,21 @@ jobs:
           fi
 
           echo "Resource purging completed successfully"
+
+      - name: Send Notification on Failure
+        if: failure()
+        run: |
+          RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
+          # Construct the email body
+          EMAIL_BODY=$(cat <<EOF
+          {
+            "body": "<p>Dear Team,</p><p>We would like to inform you that the Multi-Agent-Custom-Automation-Engine-Solution-Accelerator Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Build URL:</strong> ${RUN_URL}<br> ${OUTPUT}</p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>"
+          }
+          EOF
+          )
+
+          # Send the notification
+          curl -X POST "${{ secrets.LOGIC_APP_URL }}" \
+            -H "Content-Type: application/json" \
+            -d "$EMAIL_BODY" || echo "Failed to send notification"

From f7ad2c2c569ed704fc560c6866024026bc1d05c8 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Fri, 4 Jul 2025 12:42:09 +0530
Subject: [PATCH 04/70] edit

---
 .github/workflows/deploy-waf.yml | 2 +-
 .github/workflows/deploy.yml     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/deploy-waf.yml b/.github/workflows/deploy-waf.yml
index 9feaec793..19db281ff 100644
--- a/.github/workflows/deploy-waf.yml
+++ b/.github/workflows/deploy-waf.yml
@@ -134,7 +134,7 @@ jobs:
             --template-file infra/main.bicep \
             --parameters infra/main.waf-aligned.bicepparam \
             --parameters \
-                environmentName=${{env.SOLUTION_PREFIX}} \
+                solutionPrefix=${{env.SOLUTION_PREFIX}} \
                 solutionLocation="swedencentral" \
                 azureOpenAILocation="swedencentral" \
                 modelDeploymentType="GlobalStandard" \
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 9580546c1..aa22189fc 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -134,7 +134,7 @@ jobs:
             --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
             --template-file infra/main.bicep \
             --parameters \
-                environmentName=${{env.SOLUTION_PREFIX}} \
+                solutionPrefix=${{env.SOLUTION_PREFIX}} \
                 solutionLocation="swedencentral" \
                 azureOpenAILocation="swedencentral" \
                 modelDeploymentType="GlobalStandard" \

From aa9829928e31ab694f74d95a29767cfc056ef2ca Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Fri, 4 Jul 2025 13:31:20 +0530
Subject: [PATCH 05/70] changed api version

---
 .github/workflows/test-automation.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index db66cb864..4b31a3271 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -55,7 +55,7 @@ jobs:
         with:
           azcliversion: "latest"
           inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ vars.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ vars.MACAE_BACKEND_CONTAINER_NAME }}/start?api-version=2025-01-01"
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ vars.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ vars.MACAE_BACKEND_CONTAINER_NAME }}/start?api-version=2025-04-01"
 
       - name: Install dependencies
         run: |

From d039b91c8900d9cac0e2720f0104241f65fead44 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Fri, 4 Jul 2025 14:14:39 +0530
Subject: [PATCH 06/70] edit1

---
 .github/workflows/deploy.yml          | 4 ++--
 .github/workflows/test-automation.yml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index aa22189fc..838b02c59 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -135,8 +135,8 @@ jobs:
             --template-file infra/main.bicep \
             --parameters \
                 solutionPrefix=${{env.SOLUTION_PREFIX}} \
-                solutionLocation="swedencentral" \
-                azureOpenAILocation="swedencentral" \
+                solutionLocation="${{AZURE_LOCATION}}" \
+                azureOpenAILocation="${{AZURE_LOCATION}}" \
                 modelDeploymentType="GlobalStandard" \
                 gptModelName="gpt-4o" \
                 gptModelVersion="2024-08-06" \
diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index 4b31a3271..db66cb864 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -55,7 +55,7 @@ jobs:
         with:
           azcliversion: "latest"
           inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ vars.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ vars.MACAE_BACKEND_CONTAINER_NAME }}/start?api-version=2025-04-01"
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ vars.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ vars.MACAE_BACKEND_CONTAINER_NAME }}/start?api-version=2025-01-01"
 
       - name: Install dependencies
         run: |

From b0e74c91184fe810482bcc6574acee772cdb9377 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Fri, 4 Jul 2025 14:17:32 +0530
Subject: [PATCH 07/70] edit1

---
 .github/workflows/deploy.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 838b02c59..2defff1ea 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -135,8 +135,8 @@ jobs:
             --template-file infra/main.bicep \
             --parameters \
                 solutionPrefix=${{env.SOLUTION_PREFIX}} \
-                solutionLocation="${{AZURE_LOCATION}}" \
-                azureOpenAILocation="${{AZURE_LOCATION}}" \
+                solutionLocation="${{env.AZURE_LOCATION}}" \
+                azureOpenAILocation="${{env.AZURE_LOCATION}}" \
                 modelDeploymentType="GlobalStandard" \
                 gptModelName="gpt-4o" \
                 gptModelVersion="2024-08-06" \

From ffa63e6701e83fadeaef2491784e2b14e92324e9 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Mon, 7 Jul 2025 12:41:03 +0530
Subject: [PATCH 08/70] edit

---
 .github/workflows/deploy.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 2defff1ea..d8631b283 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -140,7 +140,7 @@ jobs:
                 modelDeploymentType="GlobalStandard" \
                 gptModelName="gpt-4o" \
                 gptModelVersion="2024-08-06" \
-                imageTag="${IMAGE_TAG}"
+                imageTag="${{IMAGE_TAG}}"
 
       - name: Extract Web App and API App URLs
         id: get_output # <-- Add this

From 10ef654358160f78e742301b346b582e8a373e15 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Mon, 7 Jul 2025 12:49:33 +0530
Subject: [PATCH 09/70] edit

---
 .github/workflows/deploy.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index d8631b283..2defff1ea 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -140,7 +140,7 @@ jobs:
                 modelDeploymentType="GlobalStandard" \
                 gptModelName="gpt-4o" \
                 gptModelVersion="2024-08-06" \
-                imageTag="${{IMAGE_TAG}}"
+                imageTag="${IMAGE_TAG}"
 
       - name: Extract Web App and API App URLs
         id: get_output # <-- Add this

From 229500ef3436c8543b9ab94994db3d05aae74e26 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Mon, 7 Jul 2025 15:33:10 +0530
Subject: [PATCH 10/70] edit

---
 .github/workflows/deploy.yml |     3 +-
 infra/main.json              | 38787 +++++++++++++++++++++++++++++++++
 2 files changed, 38789 insertions(+), 1 deletion(-)
 create mode 100644 infra/main.json

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 2defff1ea..f594c9eb4 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -140,7 +140,8 @@ jobs:
                 modelDeploymentType="GlobalStandard" \
                 gptModelName="gpt-4o" \
                 gptModelVersion="2024-08-06" \
-                imageTag="${IMAGE_TAG}"
+                imageTag="${IMAGE_TAG}" \
+                gptdeploymentCapacity="${{env.GPT_MIN_CAPACITY}}"
 
       - name: Extract Web App and API App URLs
         id: get_output # <-- Add this
diff --git a/infra/main.json b/infra/main.json
new file mode 100644
index 000000000..f2f142ff3
--- /dev/null
+++ b/infra/main.json
@@ -0,0 +1,38787 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "languageVersion": "2.0",
+  "contentVersion": "1.0.0.0",
+  "metadata": {
+    "_generator": {
+      "name": "bicep",
+      "version": "0.36.1.42791",
+      "templateHash": "7207933567592070628"
+    },
+    "name": "Multi-Agent Custom Automation Engine",
+    "description": "This module contains the resources required to deploy the Multi-Agent Custom Automation Engine solution accelerator for both Sandbox environments and WAF aligned environments."
+  },
+  "definitions": {
+    "logAnalyticsWorkspaceConfigurationType": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. If the Log Analytics Workspace resource should be deployed or not."
+          }
+        },
+        "name": {
+          "type": "string",
+          "nullable": true,
+          "maxLength": 63,
+          "metadata": {
+            "description": "Optional. The name of the Log Analytics Workspace resource."
+          }
+        },
+        "location": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "azd": {
+              "type": "location"
+            },
+            "description": "Optional. Location for the Log Analytics Workspace resource."
+          }
+        },
+        "tags": {
+          "type": "object",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The tags to for the Log Analytics Workspace resource."
+          }
+        },
+        "sku": {
+          "type": "string",
+          "allowedValues": [
+            "CapacityReservation",
+            "Free",
+            "LACluster",
+            "PerGB2018",
+            "PerNode",
+            "Premium",
+            "Standalone",
+            "Standard"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The SKU for the Log Analytics Workspace resource."
+          }
+        },
+        "dataRetentionInDays": {
+          "type": "int",
+          "nullable": true,
+          "maxValue": 730,
+          "metadata": {
+            "description": "Optional. The number of days to retain the data in the Log Analytics Workspace. If empty, it will be set to 365 days."
+          }
+        },
+        "existingWorkspaceResourceId": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional: Existing Log Analytics Workspace Resource ID"
+          }
+        }
+      },
+      "metadata": {
+        "__bicep_export!": true,
+        "description": "The type for the Multi-Agent Custom Automation Engine Log Analytics Workspace resource configuration."
+      }
+    },
+    "applicationInsightsConfigurationType": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. If the Application Insights resource should be deployed or not."
+          }
+        },
+        "name": {
+          "type": "string",
+          "nullable": true,
+          "maxLength": 90,
+          "metadata": {
+            "description": "Optional. The name of the Application Insights resource."
+          }
+        },
+        "location": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "azd": {
+              "type": "location"
+            },
+            "description": "Optional. Location for the Application Insights resource."
+          }
+        },
+        "tags": {
+          "type": "object",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The tags to set for the Application Insights resource."
+          }
+        },
+        "retentionInDays": {
+          "type": "int",
+          "allowedValues": [
+            120,
+            180,
+            270,
+            30,
+            365,
+            550,
+            60,
+            730,
+            90
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The retention of Application Insights data in days. If empty, Standard will be used."
+          }
+        }
+      },
+      "metadata": {
+        "__bicep_export!": true,
+        "description": "The type for the Multi-Agent Custom Automation Engine Application Insights resource configuration."
+      }
+    },
+    "userAssignedManagedIdentityType": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. If the User Assigned Managed Identity resource should be deployed or not."
+          }
+        },
+        "name": {
+          "type": "string",
+          "nullable": true,
+          "maxLength": 128,
+          "metadata": {
+            "description": "Optional. The name of the User Assigned Managed Identity resource."
+          }
+        },
+        "location": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "azd": {
+              "type": "location"
+            },
+            "description": "Optional. Location for the User Assigned Managed Identity resource."
+          }
+        },
+        "tags": {
+          "type": "object",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The tags to set for the User Assigned Managed Identity resource."
+          }
+        }
+      },
+      "metadata": {
+        "__bicep_export!": true,
+        "description": "The type for the Multi-Agent Custom Automation Engine Application User Assigned Managed Identity resource configuration."
+      }
+    },
+    "networkSecurityGroupConfigurationType": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. If the Network Security Group resource should be deployed or not."
+          }
+        },
+        "name": {
+          "type": "string",
+          "nullable": true,
+          "maxLength": 90,
+          "metadata": {
+            "description": "Optional. The name of the Network Security Group resource."
+          }
+        },
+        "location": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "azd": {
+              "type": "location"
+            },
+            "description": "Optional. Location for the Network Security Group resource."
+          }
+        },
+        "tags": {
+          "type": "object",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The tags to set for the Network Security Group resource."
+          }
+        },
+        "securityRules": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/securityRuleType"
+          },
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The security rules to set for the Network Security Group resource."
+          }
+        }
+      },
+      "metadata": {
+        "description": "The type for the Multi-Agent Custom Automation Engine Network Security Group resource configuration."
+      }
+    },
+    "virtualNetworkConfigurationType": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. If the Virtual Network resource should be deployed or not."
+          }
+        },
+        "name": {
+          "type": "string",
+          "nullable": true,
+          "maxLength": 90,
+          "metadata": {
+            "description": "Optional. The name of the Virtual Network resource."
+          }
+        },
+        "location": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "azd": {
+              "type": "location"
+            },
+            "description": "Optional. Location for the Virtual Network resource."
+          }
+        },
+        "tags": {
+          "type": "object",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The tags to set for the Virtual Network resource."
+          }
+        },
+        "addressPrefixes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. An array of 1 or more IP Addresses prefixes for the Virtual Network resource."
+          }
+        },
+        "subnets": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/subnetType"
+          },
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. An array of 1 or more subnets for the Virtual Network resource."
+          }
+        }
+      },
+      "metadata": {
+        "__bicep_export!": true,
+        "description": "The type for the Multi-Agent Custom Automation virtual network resource configuration."
+      }
+    },
+    "subnetType": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "metadata": {
+            "description": "Optional. The Name of the subnet resource."
+          }
+        },
+        "addressPrefix": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Conditional. The address prefix for the subnet. Required if `addressPrefixes` is empty."
+          }
+        },
+        "addressPrefixes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "nullable": true,
+          "metadata": {
+            "description": "Conditional. List of address prefixes for the subnet. Required if `addressPrefix` is empty."
+          }
+        },
+        "applicationGatewayIPConfigurations": {
+          "type": "array",
+          "items": {
+            "type": "object"
+          },
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Application gateway IP configurations of virtual network resource."
+          }
+        },
+        "delegation": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The delegation to enable on the subnet."
+          }
+        },
+        "natGatewayResourceId": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The resource ID of the NAT Gateway to use for the subnet."
+          }
+        },
+        "networkSecurityGroupResourceId": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The resource ID of the network security group to assign to the subnet."
+          }
+        },
+        "privateEndpointNetworkPolicies": {
+          "type": "string",
+          "allowedValues": [
+            "Disabled",
+            "Enabled",
+            "NetworkSecurityGroupEnabled",
+            "RouteTableEnabled"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. enable or disable apply network policies on private endpoint in the subnet."
+          }
+        },
+        "privateLinkServiceNetworkPolicies": {
+          "type": "string",
+          "allowedValues": [
+            "Disabled",
+            "Enabled"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. enable or disable apply network policies on private link service in the subnet."
+          }
+        },
+        "roleAssignments": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/roleAssignmentType"
+          },
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Array of role assignments to create."
+          }
+        },
+        "routeTableResourceId": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The resource ID of the route table to assign to the subnet."
+          }
+        },
+        "serviceEndpointPolicies": {
+          "type": "array",
+          "items": {
+            "type": "object"
+          },
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. An array of service endpoint policies."
+          }
+        },
+        "serviceEndpoints": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The service endpoints to enable on the subnet."
+          }
+        },
+        "defaultOutboundAccess": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Set this property to false to disable default outbound connectivity for all VMs in the subnet. This property can only be set at the time of subnet creation and cannot be updated for an existing subnet."
+          }
+        },
+        "sharingScope": {
+          "type": "string",
+          "allowedValues": [
+            "DelegatedServices",
+            "Tenant"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Set this property to Tenant to allow sharing subnet with other subscriptions in your AAD tenant. This property can only be set if defaultOutboundAccess is set to false, both properties can only be set if subnet is empty."
+          }
+        }
+      }
+    },
+    "bastionConfigurationType": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. If the Bastion resource should be deployed or not."
+          }
+        },
+        "name": {
+          "type": "string",
+          "nullable": true,
+          "maxLength": 90,
+          "metadata": {
+            "description": "Optional. The name of the Bastion resource."
+          }
+        },
+        "location": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "azd": {
+              "type": "location"
+            },
+            "description": "Optional. Location for the Bastion resource."
+          }
+        },
+        "tags": {
+          "type": "object",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The tags to set for the Bastion resource."
+          }
+        },
+        "sku": {
+          "type": "string",
+          "allowedValues": [
+            "Basic",
+            "Developer",
+            "Premium",
+            "Standard"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The SKU for the Bastion resource."
+          }
+        },
+        "virtualNetworkResourceId": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The Virtual Network resource id where the Bastion resource should be deployed."
+          }
+        },
+        "publicIpResourceName": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The name of the Public Ip resource created to connect to Bastion."
+          }
+        }
+      },
+      "metadata": {
+        "__bicep_export!": true,
+        "description": "The type for the Multi-Agent Custom Automation Engine Bastion resource configuration."
+      }
+    },
+    "virtualMachineConfigurationType": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. If the Virtual Machine resource should be deployed or not."
+          }
+        },
+        "name": {
+          "type": "string",
+          "nullable": true,
+          "maxLength": 90,
+          "metadata": {
+            "description": "Optional. The name of the Virtual Machine resource."
+          }
+        },
+        "location": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "azd": {
+              "type": "location"
+            },
+            "description": "Optional. Location for the Virtual Machine resource."
+          }
+        },
+        "tags": {
+          "type": "object",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The tags to set for the Virtual Machine resource."
+          }
+        },
+        "vmSize": {
+          "type": "string",
+          "allowedValues": [
+            "Basic_A0",
+            "Basic_A1",
+            "Basic_A2",
+            "Basic_A3",
+            "Basic_A4",
+            "Standard_A0",
+            "Standard_A1",
+            "Standard_A10",
+            "Standard_A11",
+            "Standard_A1_v2",
+            "Standard_A2",
+            "Standard_A2_v2",
+            "Standard_A2m_v2",
+            "Standard_A3",
+            "Standard_A4",
+            "Standard_A4_v2",
+            "Standard_A4m_v2",
+            "Standard_A5",
+            "Standard_A6",
+            "Standard_A7",
+            "Standard_A8",
+            "Standard_A8_v2",
+            "Standard_A8m_v2",
+            "Standard_A9",
+            "Standard_B1ms",
+            "Standard_B1s",
+            "Standard_B2ms",
+            "Standard_B2s",
+            "Standard_B4ms",
+            "Standard_B8ms",
+            "Standard_D1",
+            "Standard_D11",
+            "Standard_D11_v2",
+            "Standard_D12",
+            "Standard_D12_v2",
+            "Standard_D13",
+            "Standard_D13_v2",
+            "Standard_D14",
+            "Standard_D14_v2",
+            "Standard_D15_v2",
+            "Standard_D16_v3",
+            "Standard_D16s_v3",
+            "Standard_D1_v2",
+            "Standard_D2",
+            "Standard_D2_v2",
+            "Standard_D2_v3",
+            "Standard_D2s_v3",
+            "Standard_D3",
+            "Standard_D32_v3",
+            "Standard_D32s_v3",
+            "Standard_D3_v2",
+            "Standard_D4",
+            "Standard_D4_v2",
+            "Standard_D4_v3",
+            "Standard_D4s_v3",
+            "Standard_D5_v2",
+            "Standard_D64_v3",
+            "Standard_D64s_v3",
+            "Standard_D8_v3",
+            "Standard_D8s_v3",
+            "Standard_DS1",
+            "Standard_DS11",
+            "Standard_DS11_v2",
+            "Standard_DS12",
+            "Standard_DS12_v2",
+            "Standard_DS13",
+            "Standard_DS13-2_v2",
+            "Standard_DS13-4_v2",
+            "Standard_DS13_v2",
+            "Standard_DS14",
+            "Standard_DS14-4_v2",
+            "Standard_DS14-8_v2",
+            "Standard_DS14_v2",
+            "Standard_DS15_v2",
+            "Standard_DS1_v2",
+            "Standard_DS2",
+            "Standard_DS2_v2",
+            "Standard_DS3",
+            "Standard_DS3_v2",
+            "Standard_DS4",
+            "Standard_DS4_v2",
+            "Standard_DS5_v2",
+            "Standard_E16_v3",
+            "Standard_E16s_v3",
+            "Standard_E2_v3",
+            "Standard_E2s_v3",
+            "Standard_E32-16_v3",
+            "Standard_E32-8s_v3",
+            "Standard_E32_v3",
+            "Standard_E32s_v3",
+            "Standard_E4_v3",
+            "Standard_E4s_v3",
+            "Standard_E64-16s_v3",
+            "Standard_E64-32s_v3",
+            "Standard_E64_v3",
+            "Standard_E64s_v3",
+            "Standard_E8_v3",
+            "Standard_E8s_v3",
+            "Standard_F1",
+            "Standard_F16",
+            "Standard_F16s",
+            "Standard_F16s_v2",
+            "Standard_F1s",
+            "Standard_F2",
+            "Standard_F2s",
+            "Standard_F2s_v2",
+            "Standard_F32s_v2",
+            "Standard_F4",
+            "Standard_F4s",
+            "Standard_F4s_v2",
+            "Standard_F64s_v2",
+            "Standard_F72s_v2",
+            "Standard_F8",
+            "Standard_F8s",
+            "Standard_F8s_v2",
+            "Standard_G1",
+            "Standard_G2",
+            "Standard_G3",
+            "Standard_G4",
+            "Standard_G5",
+            "Standard_GS1",
+            "Standard_GS2",
+            "Standard_GS3",
+            "Standard_GS4",
+            "Standard_GS4-4",
+            "Standard_GS4-8",
+            "Standard_GS5",
+            "Standard_GS5-16",
+            "Standard_GS5-8",
+            "Standard_H16",
+            "Standard_H16m",
+            "Standard_H16mr",
+            "Standard_H16r",
+            "Standard_H8",
+            "Standard_H8m",
+            "Standard_L16s",
+            "Standard_L32s",
+            "Standard_L4s",
+            "Standard_L8s",
+            "Standard_M128-32ms",
+            "Standard_M128-64ms",
+            "Standard_M128ms",
+            "Standard_M128s",
+            "Standard_M64-16ms",
+            "Standard_M64-32ms",
+            "Standard_M64ms",
+            "Standard_M64s",
+            "Standard_NC12",
+            "Standard_NC12s_v2",
+            "Standard_NC12s_v3",
+            "Standard_NC24",
+            "Standard_NC24r",
+            "Standard_NC24rs_v2",
+            "Standard_NC24rs_v3",
+            "Standard_NC24s_v2",
+            "Standard_NC24s_v3",
+            "Standard_NC6",
+            "Standard_NC6s_v2",
+            "Standard_NC6s_v3",
+            "Standard_ND12s",
+            "Standard_ND24rs",
+            "Standard_ND24s",
+            "Standard_ND6s",
+            "Standard_NV12",
+            "Standard_NV24",
+            "Standard_NV6"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Specifies the size for the Virtual Machine resource."
+          }
+        },
+        "adminUsername": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The username for the administrator account on the virtual machine. Required if a virtual machine is created as part of the module."
+          }
+        },
+        "adminPassword": {
+          "type": "securestring",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The password for the administrator account on the virtual machine. Required if a virtual machine is created as part of the module."
+          }
+        },
+        "subnetResourceId": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The resource ID of the subnet where the Virtual Machine resource should be deployed."
+          }
+        }
+      },
+      "metadata": {
+        "__bicep_export!": true,
+        "description": "The type for the Multi-Agent Custom Automation Engine virtual machine resource configuration."
+      }
+    },
+    "aiServicesConfigurationType": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. If the AI Services resource should be deployed or not."
+          }
+        },
+        "name": {
+          "type": "string",
+          "nullable": true,
+          "maxLength": 90,
+          "metadata": {
+            "description": "Optional. The name of the AI Services resource."
+          }
+        },
+        "location": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "azd": {
+              "type": "location"
+            },
+            "description": "Optional. Location for the AI Services resource."
+          }
+        },
+        "tags": {
+          "type": "object",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The tags to set for the AI Services resource."
+          }
+        },
+        "sku": {
+          "type": "string",
+          "allowedValues": [
+            "C2",
+            "C3",
+            "C4",
+            "F0",
+            "F1",
+            "S",
+            "S0",
+            "S1",
+            "S10",
+            "S2",
+            "S3",
+            "S4",
+            "S5",
+            "S6",
+            "S7",
+            "S8",
+            "S9"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The SKU of the AI Services resource. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region."
+          }
+        },
+        "subnetResourceId": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The resource Id of the subnet where the AI Services private endpoint should be created."
+          }
+        },
+        "deployments": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/deploymentType"
+          },
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The model deployments to set for the AI Services resource."
+          }
+        },
+        "modelCapacity": {
+          "type": "int",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The capacity to set for AI Services GTP model."
+          }
+        }
+      },
+      "metadata": {
+        "description": "The type for the Multi-Agent Custom Automation Engine AI Services resource configuration."
+      }
+    },
+    "aiProjectConfigurationType": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. If the AI Project resource should be deployed or not."
+          }
+        },
+        "name": {
+          "type": "string",
+          "nullable": true,
+          "maxLength": 90,
+          "metadata": {
+            "description": "Optional. The name of the AI Project resource."
+          }
+        },
+        "location": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "azd": {
+              "type": "location"
+            },
+            "description": "Optional. Location for the AI Project resource deployment."
+          }
+        },
+        "sku": {
+          "type": "string",
+          "allowedValues": [
+            "Basic",
+            "Free",
+            "Premium",
+            "Standard"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The SKU of the AI Project resource."
+          }
+        },
+        "tags": {
+          "type": "object",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The tags to set for the AI Project resource."
+          }
+        }
+      },
+      "metadata": {
+        "__bicep_export!": true,
+        "description": "The type for the Multi-Agent Custom Automation Engine AI Foundry AI Project resource configuration."
+      }
+    },
+    "cosmosDbAccountConfigurationType": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. If the Cosmos DB Account resource should be deployed or not."
+          }
+        },
+        "name": {
+          "type": "string",
+          "nullable": true,
+          "maxLength": 60,
+          "metadata": {
+            "description": "Optional. The name of the Cosmos DB Account resource."
+          }
+        },
+        "location": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "azd": {
+              "type": "location"
+            },
+            "description": "Optional. Location for the Cosmos DB Account resource."
+          }
+        },
+        "tags": {
+          "type": "object",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The tags to set for the Cosmos DB Account resource."
+          }
+        },
+        "subnetResourceId": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The resource Id of the subnet where the Cosmos DB Account private endpoint should be created."
+          }
+        },
+        "sqlDatabases": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/sqlDatabaseType"
+          },
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The SQL databases configuration for the Cosmos DB Account resource."
+          }
+        }
+      },
+      "metadata": {
+        "__bicep_export!": true,
+        "description": "The type for the Multi-Agent Custom Automation Engine Cosmos DB Account resource configuration."
+      }
+    },
+    "containerAppEnvironmentConfigurationType": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. If the Container App Environment resource should be deployed or not."
+          }
+        },
+        "name": {
+          "type": "string",
+          "nullable": true,
+          "maxLength": 60,
+          "metadata": {
+            "description": "Optional. The name of the Container App Environment resource."
+          }
+        },
+        "location": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "azd": {
+              "type": "location"
+            },
+            "description": "Optional. Location for the Container App Environment resource."
+          }
+        },
+        "tags": {
+          "type": "object",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The tags to set for the Container App Environment resource."
+          }
+        },
+        "subnetResourceId": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The resource Id of the subnet where the Container App Environment private endpoint should be created."
+          }
+        }
+      },
+      "metadata": {
+        "__bicep_export!": true,
+        "description": "The type for the Multi-Agent Custom Automation Engine Container App Environment resource configuration."
+      }
+    },
+    "containerAppConfigurationType": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. If the Container App resource should be deployed or not."
+          }
+        },
+        "name": {
+          "type": "string",
+          "nullable": true,
+          "maxLength": 60,
+          "metadata": {
+            "description": "Optional. The name of the Container App resource."
+          }
+        },
+        "location": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "azd": {
+              "type": "location"
+            },
+            "description": "Optional. Location for the Container App resource."
+          }
+        },
+        "tags": {
+          "type": "object",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The tags to set for the Container App resource."
+          }
+        },
+        "environmentResourceId": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The resource Id of the Container App Environment where the Container App should be created."
+          }
+        },
+        "maxReplicas": {
+          "type": "int",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The maximum number of replicas of the Container App."
+          }
+        },
+        "minReplicas": {
+          "type": "int",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The minimum number of replicas of the Container App."
+          }
+        },
+        "ingressTargetPort": {
+          "type": "int",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The ingress target port of the Container App."
+          }
+        },
+        "concurrentRequests": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The concurrent requests allowed for the Container App."
+          }
+        },
+        "containerName": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The name given to the Container App."
+          }
+        },
+        "containerImageRegistryDomain": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The container registry domain of the container image to be used by the Container App. Default to `biabcontainerreg.azurecr.io`"
+          }
+        },
+        "containerImageName": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The name of the container image to be used by the Container App."
+          }
+        },
+        "containerImageTag": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The tag of the container image to be used by the Container App."
+          }
+        },
+        "containerCpu": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The CPU reserved for the Container App. Defaults to 2.0"
+          }
+        },
+        "containerMemory": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The Memory reserved for the Container App. Defaults to 4.0Gi"
+          }
+        }
+      },
+      "metadata": {
+        "__bicep_export!": true,
+        "description": "The type for the Multi-Agent Custom Automation Engine Container App resource configuration."
+      }
+    },
+    "entraIdApplicationConfigurationType": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. If the Entra ID Application for website authentication should be deployed or not."
+          }
+        }
+      },
+      "metadata": {
+        "__bicep_export!": true,
+        "description": "The type for the Multi-Agent Custom Automation Engine Entra ID Application resource configuration."
+      }
+    },
+    "webServerFarmConfigurationType": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. If the Web Server Farm resource should be deployed or not."
+          }
+        },
+        "name": {
+          "type": "string",
+          "nullable": true,
+          "maxLength": 60,
+          "metadata": {
+            "description": "Optional. The name of the Web Server Farm resource."
+          }
+        },
+        "location": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "azd": {
+              "type": "location"
+            },
+            "description": "Optional. Location for the Web Server Farm resource."
+          }
+        },
+        "tags": {
+          "type": "object",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The tags to set for the Web Server Farm resource."
+          }
+        },
+        "skuName": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The name of th SKU that will determine the tier, size and family for the Web Server Farm resource. This defaults to P1v3 to leverage availability zones."
+          }
+        },
+        "skuCapacity": {
+          "type": "int",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Number of workers associated with the App Service Plan. This defaults to 3, to leverage availability zones."
+          }
+        }
+      },
+      "metadata": {
+        "__bicep_export!": true,
+        "description": "The type for the Multi-Agent Custom Automation Engine Web Server Farm resource configuration."
+      }
+    },
+    "webSiteConfigurationType": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. If the Web Site resource should be deployed or not."
+          }
+        },
+        "name": {
+          "type": "string",
+          "nullable": true,
+          "maxLength": 60,
+          "metadata": {
+            "description": "Optional. The name of the Web Site resource."
+          }
+        },
+        "location": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "azd": {
+              "type": "location"
+            },
+            "description": "Optional. Location for the Web Site resource deployment."
+          }
+        },
+        "tags": {
+          "type": "object",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The tags to set for the Web Site resource."
+          }
+        },
+        "environmentResourceId": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The resource Id of the Web Site Environment where the Web Site should be created."
+          }
+        },
+        "containerName": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The name given to the Container App."
+          }
+        },
+        "containerImageRegistryDomain": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The container registry domain of the container image to be used by the Web Site. Default to `biabcontainerreg.azurecr.io`"
+          }
+        },
+        "containerImageName": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The name of the container image to be used by the Web Site."
+          }
+        },
+        "containerImageTag": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The tag of the container image to be used by the Web Site."
+          }
+        }
+      },
+      "metadata": {
+        "__bicep_export!": true,
+        "description": "The type for the Multi-Agent Custom Automation Engine Web Site resource configuration."
+      }
+    },
+    "deploymentType": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Specify the name of cognitive service account deployment."
+          }
+        },
+        "model": {
+          "type": "object",
+          "properties": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. The name of Cognitive Services account deployment model."
+              }
+            },
+            "format": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. The format of Cognitive Services account deployment model."
+              }
+            },
+            "version": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. The version of Cognitive Services account deployment model."
+              }
+            }
+          },
+          "metadata": {
+            "description": "Required. Properties of Cognitive Services account deployment model."
+          }
+        },
+        "sku": {
+          "type": "object",
+          "properties": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. The name of the resource model definition representing SKU."
+              }
+            },
+            "capacity": {
+              "type": "int",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The capacity of the resource model definition representing SKU."
+              }
+            },
+            "tier": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The tier of the resource model definition representing SKU."
+              }
+            },
+            "size": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The size of the resource model definition representing SKU."
+              }
+            },
+            "family": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The family of the resource model definition representing SKU."
+              }
+            }
+          },
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The resource model definition representing SKU."
+          }
+        },
+        "raiPolicyName": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The name of RAI policy."
+          }
+        },
+        "versionUpgradeOption": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The version upgrade option."
+          }
+        }
+      },
+      "metadata": {
+        "description": "The type for a cognitive services account deployment.",
+        "__bicep_imported_from!": {
+          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/cognitive-services/account:0.10.2"
+        }
+      }
+    },
+    "roleAssignmentType": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+          }
+        },
+        "roleDefinitionIdOrName": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+          }
+        },
+        "principalId": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+          }
+        },
+        "principalType": {
+          "type": "string",
+          "allowedValues": [
+            "Device",
+            "ForeignGroup",
+            "Group",
+            "ServicePrincipal",
+            "User"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The principal type of the assigned principal ID."
+          }
+        },
+        "description": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The description of the role assignment."
+          }
+        },
+        "condition": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+          }
+        },
+        "conditionVersion": {
+          "type": "string",
+          "allowedValues": [
+            "2.0"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Version of the condition."
+          }
+        },
+        "delegatedManagedIdentityResourceId": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The Resource Id of the delegated managed identity resource."
+          }
+        }
+      },
+      "metadata": {
+        "description": "An AVM-aligned type for a role assignment.",
+        "__bicep_imported_from!": {
+          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+        }
+      }
+    },
+    "securityRuleType": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The name of the security rule."
+          }
+        },
+        "properties": {
+          "type": "object",
+          "properties": {
+            "access": {
+              "type": "string",
+              "allowedValues": [
+                "Allow",
+                "Deny"
+              ],
+              "metadata": {
+                "description": "Required. Whether network traffic is allowed or denied."
+              }
+            },
+            "description": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The description of the security rule."
+              }
+            },
+            "destinationAddressPrefix": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Optional. The destination address prefix. CIDR or destination IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used."
+              }
+            },
+            "destinationAddressPrefixes": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The destination address prefixes. CIDR or destination IP ranges."
+              }
+            },
+            "destinationApplicationSecurityGroupResourceIds": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The resource IDs of the application security groups specified as destination."
+              }
+            },
+            "destinationPortRange": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The destination port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+              }
+            },
+            "destinationPortRanges": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The destination port ranges."
+              }
+            },
+            "direction": {
+              "type": "string",
+              "allowedValues": [
+                "Inbound",
+                "Outbound"
+              ],
+              "metadata": {
+                "description": "Required. The direction of the rule. The direction specifies if rule will be evaluated on incoming or outgoing traffic."
+              }
+            },
+            "priority": {
+              "type": "int",
+              "minValue": 100,
+              "maxValue": 4096,
+              "metadata": {
+                "description": "Required. Required. The priority of the rule. The value can be between 100 and 4096. The priority number must be unique for each rule in the collection. The lower the priority number, the higher the priority of the rule."
+              }
+            },
+            "protocol": {
+              "type": "string",
+              "allowedValues": [
+                "*",
+                "Ah",
+                "Esp",
+                "Icmp",
+                "Tcp",
+                "Udp"
+              ],
+              "metadata": {
+                "description": "Required. Network protocol this rule applies to."
+              }
+            },
+            "sourceAddressPrefix": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The CIDR or source IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used. If this is an ingress rule, specifies where network traffic originates from."
+              }
+            },
+            "sourceAddressPrefixes": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The CIDR or source IP ranges."
+              }
+            },
+            "sourceApplicationSecurityGroupResourceIds": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The resource IDs of the application security groups specified as source."
+              }
+            },
+            "sourcePortRange": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The source port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+              }
+            },
+            "sourcePortRanges": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The source port ranges."
+              }
+            }
+          },
+          "metadata": {
+            "description": "Required. The properties of the security rule."
+          }
+        }
+      },
+      "metadata": {
+        "description": "The type of a security rule.",
+        "__bicep_imported_from!": {
+          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-security-group:0.5.1"
+        }
+      }
+    },
+    "sqlDatabaseType": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. Name of the SQL database ."
+          }
+        },
+        "throughput": {
+          "type": "int",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Default to 400. Request units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+          }
+        },
+        "autoscaleSettingsMaxThroughput": {
+          "type": "int",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+          }
+        },
+        "containers": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "metadata": {
+                  "description": "Required. Name of the container."
+                }
+              },
+              "paths": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                },
+                "minLength": 1,
+                "maxLength": 3,
+                "metadata": {
+                  "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1."
+                }
+              },
+              "analyticalStorageTtl": {
+                "type": "int",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store."
+                }
+              },
+              "autoscaleSettingsMaxThroughput": {
+                "type": "int",
+                "nullable": true,
+                "maxValue": 1000000,
+                "metadata": {
+                  "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level."
+                }
+              },
+              "conflictResolutionPolicy": {
+                "type": "object",
+                "properties": {
+                  "conflictResolutionPath": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Conditional. The conflict resolution path in the case of LastWriterWins mode. Required if `mode` is set to 'LastWriterWins'."
+                    }
+                  },
+                  "conflictResolutionProcedure": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Conditional. The procedure to resolve conflicts in the case of custom mode. Required if `mode` is set to 'Custom'."
+                    }
+                  },
+                  "mode": {
+                    "type": "string",
+                    "allowedValues": [
+                      "Custom",
+                      "LastWriterWins"
+                    ],
+                    "metadata": {
+                      "description": "Required. Indicates the conflict resolution mode."
+                    }
+                  }
+                },
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions."
+                }
+              },
+              "defaultTtl": {
+                "type": "int",
+                "nullable": true,
+                "minValue": -1,
+                "maxValue": 2147483647,
+                "metadata": {
+                  "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default."
+                }
+              },
+              "indexingPolicy": {
+                "type": "object",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. Indexing policy of the container."
+                }
+              },
+              "kind": {
+                "type": "string",
+                "allowedValues": [
+                  "Hash",
+                  "MultiHash"
+                ],
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning."
+                }
+              },
+              "version": {
+                "type": "int",
+                "allowedValues": [
+                  1,
+                  2
+                ],
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition."
+                }
+              },
+              "throughput": {
+                "type": "int",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used."
+                }
+              },
+              "uniqueKeyPolicyKeys": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "paths": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "metadata": {
+                        "description": "Required. List of paths must be unique for each document in the Azure Cosmos DB service."
+                      }
+                    }
+                  }
+                },
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service."
+                }
+              }
+            }
+          },
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Array of containers to deploy in the SQL database."
+          }
+        }
+      },
+      "metadata": {
+        "description": "The type for the SQL database.",
+        "__bicep_imported_from!": {
+          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/document-db/database-account:0.13.0"
+        }
+      }
+    }
+  },
+  "parameters": {
+    "solutionPrefix": {
+      "type": "string",
+      "defaultValue": "[format('macae{0}', uniqueString(deployer().objectId, deployer().tenantId, subscription().subscriptionId, resourceGroup().id))]",
+      "maxLength": 19,
+      "metadata": {
+        "description": "Optional. The prefix to add in the default names given to all deployed Azure resources."
+      }
+    },
+    "solutionLocation": {
+      "type": "string",
+      "defaultValue": "[resourceGroup().location]",
+      "metadata": {
+        "description": "Required. Location for all Resources except AI Foundry."
+      }
+    },
+    "enableTelemetry": {
+      "type": "bool",
+      "defaultValue": true,
+      "metadata": {
+        "description": "Optional. Enable/Disable usage telemetry for module."
+      }
+    },
+    "azureOpenAILocation": {
+      "type": "string",
+      "allowedValues": [
+        "australiaeast",
+        "eastus2",
+        "francecentral",
+        "japaneast",
+        "norwayeast",
+        "swedencentral",
+        "uksouth",
+        "westus"
+      ],
+      "metadata": {
+        "description": "Azure OpenAI Location"
+      }
+    },
+    "gptModelName": {
+      "type": "string",
+      "defaultValue": "gpt-4o",
+      "minLength": 1,
+      "metadata": {
+        "description": "Name of the GPT model to deploy:"
+      }
+    },
+    "gptModelVersion": {
+      "type": "string",
+      "defaultValue": "2024-08-06"
+    },
+    "modelDeploymentType": {
+      "type": "string",
+      "defaultValue": "GlobalStandard",
+      "minLength": 1,
+      "metadata": {
+        "description": "GPT model deployment type:"
+      }
+    },
+    "imageTag": {
+      "type": "string",
+      "defaultValue": "latest",
+      "metadata": {
+        "description": "Set the image tag for the container images used in the solution. Default is \"latest\"."
+      }
+    },
+    "tags": {
+      "type": "object",
+      "defaultValue": {
+        "app": "[parameters('solutionPrefix')]",
+        "location": "[parameters('solutionLocation')]"
+      },
+      "metadata": {
+        "description": "Optional. The tags to apply to all deployed Azure resources."
+      }
+    },
+    "logAnalyticsWorkspaceConfiguration": {
+      "$ref": "#/definitions/logAnalyticsWorkspaceConfigurationType",
+      "defaultValue": {
+        "enabled": true,
+        "name": "[format('log-{0}', parameters('solutionPrefix'))]",
+        "location": "[parameters('solutionLocation')]",
+        "sku": "PerGB2018",
+        "tags": "[parameters('tags')]",
+        "dataRetentionInDays": 365,
+        "existingWorkspaceResourceId": ""
+      },
+      "metadata": {
+        "description": "Optional. The configuration to apply for the Multi-Agent Custom Automation Engine Log Analytics Workspace resource."
+      }
+    },
+    "applicationInsightsConfiguration": {
+      "$ref": "#/definitions/applicationInsightsConfigurationType",
+      "defaultValue": {
+        "enabled": true,
+        "name": "[format('appi-{0}', parameters('solutionPrefix'))]",
+        "location": "[parameters('solutionLocation')]",
+        "tags": "[parameters('tags')]",
+        "retentionInDays": 365
+      },
+      "metadata": {
+        "description": "Optional. The configuration to apply for the Multi-Agent Custom Automation Engine Application Insights resource."
+      }
+    },
+    "userAssignedManagedIdentityConfiguration": {
+      "$ref": "#/definitions/userAssignedManagedIdentityType",
+      "defaultValue": {
+        "enabled": true,
+        "name": "[format('id-{0}', parameters('solutionPrefix'))]",
+        "location": "[parameters('solutionLocation')]",
+        "tags": "[parameters('tags')]"
+      },
+      "metadata": {
+        "description": "Optional. The configuration to apply for the Multi-Agent Custom Automation Engine Managed Identity resource."
+      }
+    },
+    "networkSecurityGroupBackendConfiguration": {
+      "$ref": "#/definitions/networkSecurityGroupConfigurationType",
+      "defaultValue": {
+        "enabled": true,
+        "name": "[format('nsg-backend-{0}', parameters('solutionPrefix'))]",
+        "location": "[parameters('solutionLocation')]",
+        "tags": "[parameters('tags')]",
+        "securityRules": null
+      },
+      "metadata": {
+        "description": "Optional. The configuration to apply for the Multi-Agent Custom Automation Engine Network Security Group resource for the backend subnet."
+      }
+    },
+    "networkSecurityGroupContainersConfiguration": {
+      "$ref": "#/definitions/networkSecurityGroupConfigurationType",
+      "defaultValue": {
+        "enabled": true,
+        "name": "[format('nsg-containers-{0}', parameters('solutionPrefix'))]",
+        "location": "[parameters('solutionLocation')]",
+        "tags": "[parameters('tags')]",
+        "securityRules": null
+      },
+      "metadata": {
+        "description": "Optional. The configuration to apply for the Multi-Agent Custom Automation Engine Network Security Group resource for the containers subnet."
+      }
+    },
+    "networkSecurityGroupBastionConfiguration": {
+      "$ref": "#/definitions/networkSecurityGroupConfigurationType",
+      "defaultValue": {
+        "enabled": true,
+        "name": "[format('nsg-bastion-{0}', parameters('solutionPrefix'))]",
+        "location": "[parameters('solutionLocation')]",
+        "tags": "[parameters('tags')]",
+        "securityRules": null
+      },
+      "metadata": {
+        "description": "Optional. The configuration to apply for the Multi-Agent Custom Automation Engine Network Security Group resource for the Bastion subnet."
+      }
+    },
+    "networkSecurityGroupAdministrationConfiguration": {
+      "$ref": "#/definitions/networkSecurityGroupConfigurationType",
+      "defaultValue": {
+        "enabled": true,
+        "name": "[format('nsg-administration-{0}', parameters('solutionPrefix'))]",
+        "location": "[parameters('solutionLocation')]",
+        "tags": "[parameters('tags')]",
+        "securityRules": null
+      },
+      "metadata": {
+        "description": "Optional. The configuration to apply for the Multi-Agent Custom Automation Engine Network Security Group resource for the administration subnet."
+      }
+    },
+    "virtualNetworkConfiguration": {
+      "$ref": "#/definitions/virtualNetworkConfigurationType",
+      "defaultValue": {
+        "enabled": true,
+        "name": "[format('vnet-{0}', parameters('solutionPrefix'))]",
+        "location": "[parameters('solutionLocation')]",
+        "tags": "[parameters('tags')]",
+        "addressPrefixes": null,
+        "subnets": null
+      },
+      "metadata": {
+        "description": "Optional. The configuration to apply for the Multi-Agent Custom Automation Engine virtual network resource."
+      }
+    },
+    "bastionConfiguration": {
+      "$ref": "#/definitions/bastionConfigurationType",
+      "defaultValue": {
+        "enabled": true,
+        "name": "[format('bas-{0}', parameters('solutionPrefix'))]",
+        "location": "[parameters('solutionLocation')]",
+        "tags": "[parameters('tags')]",
+        "sku": "Standard",
+        "virtualNetworkResourceId": null,
+        "publicIpResourceName": "[format('pip-bas{0}', parameters('solutionPrefix'))]"
+      },
+      "metadata": {
+        "description": "Optional. The configuration to apply for the Multi-Agent Custom Automation Engine bastion resource."
+      }
+    },
+    "virtualMachineConfiguration": {
+      "$ref": "#/definitions/virtualMachineConfigurationType",
+      "defaultValue": {
+        "enabled": true,
+        "name": "[format('vm{0}', parameters('solutionPrefix'))]",
+        "location": "[parameters('solutionLocation')]",
+        "tags": "[parameters('tags')]",
+        "adminUsername": "adminuser",
+        "adminPassword": "[guid(parameters('solutionPrefix'), subscription().subscriptionId)]",
+        "vmSize": "Standard_D2s_v3",
+        "subnetResourceId": null
+      },
+      "metadata": {
+        "description": "Optional. Configuration for the Windows virtual machine."
+      }
+    },
+    "aiFoundryAiServicesConfiguration": {
+      "$ref": "#/definitions/aiServicesConfigurationType",
+      "defaultValue": {
+        "enabled": true,
+        "name": "[format('aisa-{0}', parameters('solutionPrefix'))]",
+        "location": "[parameters('azureOpenAILocation')]",
+        "sku": "S0",
+        "deployments": null,
+        "subnetResourceId": null,
+        "modelCapacity": 50
+      },
+      "metadata": {
+        "description": "Optional. The configuration to apply for the AI Foundry AI Services resource."
+      }
+    },
+    "aiFoundryAiProjectConfiguration": {
+      "$ref": "#/definitions/aiProjectConfigurationType",
+      "defaultValue": {
+        "enabled": true,
+        "name": "[format('aifp-{0}', parameters('solutionPrefix'))]",
+        "location": "[parameters('azureOpenAILocation')]",
+        "sku": "Basic",
+        "tags": "[parameters('tags')]"
+      },
+      "metadata": {
+        "description": "Optional. The configuration to apply for the AI Foundry AI Project resource."
+      }
+    },
+    "cosmosDbAccountConfiguration": {
+      "$ref": "#/definitions/cosmosDbAccountConfigurationType",
+      "defaultValue": {
+        "enabled": true,
+        "name": "[format('cosmos-{0}', parameters('solutionPrefix'))]",
+        "location": "[parameters('solutionLocation')]",
+        "tags": "[parameters('tags')]",
+        "subnetResourceId": null,
+        "sqlDatabases": null
+      },
+      "metadata": {
+        "description": "Optional. The configuration to apply for the Cosmos DB Account resource."
+      }
+    },
+    "containerAppEnvironmentConfiguration": {
+      "$ref": "#/definitions/containerAppEnvironmentConfigurationType",
+      "defaultValue": {
+        "enabled": true,
+        "name": "[format('cae-{0}', parameters('solutionPrefix'))]",
+        "location": "[parameters('solutionLocation')]",
+        "tags": "[parameters('tags')]",
+        "subnetResourceId": null
+      },
+      "metadata": {
+        "description": "Optional. The configuration to apply for the Container App Environment resource."
+      }
+    },
+    "containerAppConfiguration": {
+      "$ref": "#/definitions/containerAppConfigurationType",
+      "defaultValue": {
+        "enabled": true,
+        "name": "[format('ca-{0}', parameters('solutionPrefix'))]",
+        "location": "[parameters('solutionLocation')]",
+        "tags": "[parameters('tags')]",
+        "environmentResourceId": null,
+        "concurrentRequests": "100",
+        "containerCpu": "2.0",
+        "containerMemory": "4.0Gi",
+        "containerImageRegistryDomain": "biabcontainerreg.azurecr.io",
+        "containerImageName": "macaebackend",
+        "containerImageTag": "[parameters('imageTag')]",
+        "containerName": "backend",
+        "ingressTargetPort": 8000,
+        "maxReplicas": 1,
+        "minReplicas": 1
+      },
+      "metadata": {
+        "description": "Optional. The configuration to apply for the Container App resource."
+      }
+    },
+    "webServerFarmConfiguration": {
+      "$ref": "#/definitions/webServerFarmConfigurationType",
+      "defaultValue": {
+        "enabled": true,
+        "name": "[format('asp-{0}', parameters('solutionPrefix'))]",
+        "location": "[parameters('solutionLocation')]",
+        "skuName": "P1v3",
+        "skuCapacity": 3,
+        "tags": "[parameters('tags')]"
+      },
+      "metadata": {
+        "description": "Optional. The configuration to apply for the Web Server Farm resource."
+      }
+    },
+    "webSiteConfiguration": {
+      "$ref": "#/definitions/webSiteConfigurationType",
+      "defaultValue": {
+        "enabled": true,
+        "name": "[format('app-{0}', parameters('solutionPrefix'))]",
+        "location": "[parameters('solutionLocation')]",
+        "containerImageRegistryDomain": "biabcontainerreg.azurecr.io",
+        "containerImageName": "macaefrontend",
+        "containerImageTag": "[parameters('imageTag')]",
+        "containerName": "backend",
+        "tags": "[parameters('tags')]",
+        "environmentResourceId": null
+      },
+      "metadata": {
+        "description": "Optional. The configuration to apply for the Web Server Farm resource."
+      }
+    }
+  },
+  "variables": {
+    "logAnalyticsWorkspaceEnabled": "[coalesce(tryGet(parameters('logAnalyticsWorkspaceConfiguration'), 'enabled'), true())]",
+    "logAnalyticsWorkspaceResourceName": "[coalesce(tryGet(parameters('logAnalyticsWorkspaceConfiguration'), 'name'), format('log-{0}', parameters('solutionPrefix')))]",
+    "existingWorkspaceResourceId": "[coalesce(tryGet(parameters('logAnalyticsWorkspaceConfiguration'), 'existingWorkspaceResourceId'), '')]",
+    "useExistingWorkspace": "[not(equals(variables('existingWorkspaceResourceId'), ''))]",
+    "applicationInsightsEnabled": "[coalesce(tryGet(parameters('applicationInsightsConfiguration'), 'enabled'), true())]",
+    "applicationInsightsResourceName": "[coalesce(tryGet(parameters('applicationInsightsConfiguration'), 'name'), format('appi-{0}', parameters('solutionPrefix')))]",
+    "userAssignedManagedIdentityEnabled": "[coalesce(tryGet(parameters('userAssignedManagedIdentityConfiguration'), 'enabled'), true())]",
+    "userAssignedManagedIdentityResourceName": "[coalesce(tryGet(parameters('userAssignedManagedIdentityConfiguration'), 'name'), format('id-{0}', parameters('solutionPrefix')))]",
+    "networkSecurityGroupBackendEnabled": "[coalesce(tryGet(parameters('networkSecurityGroupBackendConfiguration'), 'enabled'), true())]",
+    "networkSecurityGroupBackendResourceName": "[coalesce(tryGet(parameters('networkSecurityGroupBackendConfiguration'), 'name'), format('nsg-backend-{0}', parameters('solutionPrefix')))]",
+    "networkSecurityGroupContainersEnabled": "[coalesce(tryGet(parameters('networkSecurityGroupContainersConfiguration'), 'enabled'), true())]",
+    "networkSecurityGroupContainersResourceName": "[coalesce(tryGet(parameters('networkSecurityGroupContainersConfiguration'), 'name'), format('nsg-containers-{0}', parameters('solutionPrefix')))]",
+    "networkSecurityGroupBastionEnabled": "[coalesce(tryGet(parameters('networkSecurityGroupBastionConfiguration'), 'enabled'), true())]",
+    "networkSecurityGroupBastionResourceName": "[coalesce(tryGet(parameters('networkSecurityGroupBastionConfiguration'), 'name'), format('nsg-bastion-{0}', parameters('solutionPrefix')))]",
+    "networkSecurityGroupAdministrationEnabled": "[coalesce(tryGet(parameters('networkSecurityGroupAdministrationConfiguration'), 'enabled'), true())]",
+    "networkSecurityGroupAdministrationResourceName": "[coalesce(tryGet(parameters('networkSecurityGroupAdministrationConfiguration'), 'name'), format('nsg-administration-{0}', parameters('solutionPrefix')))]",
+    "virtualNetworkEnabled": "[coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'enabled'), true())]",
+    "virtualNetworkResourceName": "[coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'name'), format('vnet-{0}', parameters('solutionPrefix')))]",
+    "bastionEnabled": "[coalesce(tryGet(parameters('bastionConfiguration'), 'enabled'), true())]",
+    "bastionResourceName": "[coalesce(tryGet(parameters('bastionConfiguration'), 'name'), format('bas-{0}', parameters('solutionPrefix')))]",
+    "virtualMachineEnabled": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'enabled'), true())]",
+    "virtualMachineResourceName": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'name'), format('vm{0}', parameters('solutionPrefix')))]",
+    "openAiSubResource": "account",
+    "openAiPrivateDnsZones": {
+      "privatelink.cognitiveservices.azure.com": "[variables('openAiSubResource')]",
+      "privatelink.openai.azure.com": "[variables('openAiSubResource')]",
+      "privatelink.services.ai.azure.com": "[variables('openAiSubResource')]"
+    },
+    "aiFoundryAiServicesResourceName": "[coalesce(tryGet(parameters('aiFoundryAiServicesConfiguration'), 'name'), format('aisa-{0}', parameters('solutionPrefix')))]",
+    "aiFoundryAIservicesEnabled": "[coalesce(tryGet(parameters('aiFoundryAiServicesConfiguration'), 'enabled'), true())]",
+    "aiFoundryAiServicesModelDeployment": {
+      "format": "OpenAI",
+      "name": "[parameters('gptModelName')]",
+      "version": "[parameters('gptModelVersion')]",
+      "sku": {
+        "name": "[parameters('modelDeploymentType')]",
+        "capacity": "[coalesce(tryGet(parameters('aiFoundryAiServicesConfiguration'), 'modelCapacity'), 50)]"
+      },
+      "raiPolicyName": "Microsoft.Default"
+    },
+    "aiFoundryAiProjectName": "[coalesce(tryGet(parameters('aiFoundryAiProjectConfiguration'), 'name'), format('aifp-{0}', parameters('solutionPrefix')))]",
+    "aiProjectDescription": "AI Foundry Project",
+    "cosmosDbAccountEnabled": "[coalesce(tryGet(parameters('cosmosDbAccountConfiguration'), 'enabled'), true())]",
+    "cosmosDbResourceName": "[coalesce(tryGet(parameters('cosmosDbAccountConfiguration'), 'name'), format('cosmos-{0}', parameters('solutionPrefix')))]",
+    "cosmosDbDatabaseName": "macae",
+    "cosmosDbDatabaseMemoryContainerName": "memory",
+    "containerAppEnvironmentEnabled": "[coalesce(tryGet(parameters('containerAppEnvironmentConfiguration'), 'enabled'), true())]",
+    "containerAppEnvironmentResourceName": "[coalesce(tryGet(parameters('containerAppEnvironmentConfiguration'), 'name'), format('cae-{0}', parameters('solutionPrefix')))]",
+    "containerAppEnabled": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'enabled'), true())]",
+    "containerAppResourceName": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'name'), format('ca-{0}', parameters('solutionPrefix')))]",
+    "webServerFarmEnabled": "[coalesce(tryGet(parameters('webServerFarmConfiguration'), 'enabled'), true())]",
+    "webServerFarmResourceName": "[coalesce(tryGet(parameters('webServerFarmConfiguration'), 'name'), format('asp-{0}', parameters('solutionPrefix')))]",
+    "webSiteEnabled": "[coalesce(tryGet(parameters('webSiteConfiguration'), 'enabled'), true())]",
+    "webSiteName": "[format('app-{0}', parameters('solutionPrefix'))]"
+  },
+  "resources": {
+    "aiServices": {
+      "existing": true,
+      "type": "Microsoft.CognitiveServices/accounts",
+      "apiVersion": "2025-04-01-preview",
+      "name": "[variables('aiFoundryAiServicesResourceName')]",
+      "dependsOn": [
+        "aiFoundryAiServices"
+      ]
+    },
+    "aiFoundryProject": {
+      "type": "Microsoft.CognitiveServices/accounts/projects",
+      "apiVersion": "2025-04-01-preview",
+      "name": "[format('{0}/{1}', variables('aiFoundryAiServicesResourceName'), variables('aiFoundryAiProjectName'))]",
+      "location": "[coalesce(tryGet(parameters('aiFoundryAiProjectConfiguration'), 'location'), parameters('azureOpenAILocation'))]",
+      "identity": {
+        "type": "SystemAssigned"
+      },
+      "properties": {
+        "description": "[variables('aiProjectDescription')]",
+        "displayName": "[variables('aiFoundryAiProjectName')]"
+      },
+      "dependsOn": [
+        "aiFoundryAiServices"
+      ]
+    },
+    "aiUser": {
+      "existing": true,
+      "type": "Microsoft.Authorization/roleDefinitions",
+      "apiVersion": "2022-04-01",
+      "name": "53ca6127-db72-4b80-b1b0-d745d6d5456d"
+    },
+    "aiUserAccessProj": {
+      "type": "Microsoft.Authorization/roleAssignments",
+      "apiVersion": "2022-04-01",
+      "scope": "[format('Microsoft.CognitiveServices/accounts/{0}/projects/{1}', variables('aiFoundryAiServicesResourceName'), variables('aiFoundryAiProjectName'))]",
+      "name": "[guid(take(format('avm.res.app.container-app.{0}', variables('containerAppResourceName')), 64), resourceId('Microsoft.CognitiveServices/accounts/projects', variables('aiFoundryAiServicesResourceName'), variables('aiFoundryAiProjectName')), resourceId('Microsoft.Authorization/roleDefinitions', '53ca6127-db72-4b80-b1b0-d745d6d5456d'))]",
+      "properties": {
+        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '53ca6127-db72-4b80-b1b0-d745d6d5456d')]",
+        "principalId": "[tryGet(tryGet(reference('containerApp').outputs, 'systemAssignedMIPrincipalId'), 'value')]"
+      },
+      "dependsOn": [
+        "aiFoundryProject",
+        "containerApp"
+      ]
+    },
+    "aiUserAccessFoundry": {
+      "type": "Microsoft.Authorization/roleAssignments",
+      "apiVersion": "2022-04-01",
+      "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', variables('aiFoundryAiServicesResourceName'))]",
+      "name": "[guid(take(format('avm.res.app.container-app.{0}', variables('containerAppResourceName')), 64), resourceId('Microsoft.CognitiveServices/accounts', variables('aiFoundryAiServicesResourceName')), resourceId('Microsoft.Authorization/roleDefinitions', '53ca6127-db72-4b80-b1b0-d745d6d5456d'))]",
+      "properties": {
+        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '53ca6127-db72-4b80-b1b0-d745d6d5456d')]",
+        "principalId": "[tryGet(tryGet(reference('containerApp').outputs, 'systemAssignedMIPrincipalId'), 'value')]"
+      },
+      "dependsOn": [
+        "aiFoundryAiServices",
+        "containerApp"
+      ]
+    },
+    "aiDeveloper": {
+      "existing": true,
+      "type": "Microsoft.Authorization/roleDefinitions",
+      "apiVersion": "2022-04-01",
+      "name": "64702f94-c441-49e6-a78b-ef80e0188fee"
+    },
+    "aiDeveloperAccessFoundry": {
+      "type": "Microsoft.Authorization/roleAssignments",
+      "apiVersion": "2022-04-01",
+      "scope": "[format('Microsoft.CognitiveServices/accounts/{0}/projects/{1}', variables('aiFoundryAiServicesResourceName'), variables('aiFoundryAiProjectName'))]",
+      "name": "[guid(take(format('avm.res.app.container-app.{0}', variables('containerAppResourceName')), 64), resourceId('Microsoft.CognitiveServices/accounts', variables('aiFoundryAiServicesResourceName')), resourceId('Microsoft.Authorization/roleDefinitions', '64702f94-c441-49e6-a78b-ef80e0188fee'))]",
+      "properties": {
+        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '64702f94-c441-49e6-a78b-ef80e0188fee')]",
+        "principalId": "[tryGet(tryGet(reference('containerApp').outputs, 'systemAssignedMIPrincipalId'), 'value')]"
+      },
+      "dependsOn": [
+        "aiFoundryAiServices",
+        "aiFoundryProject",
+        "containerApp"
+      ]
+    },
+    "cognitiveServiceOpenAIUser": {
+      "existing": true,
+      "type": "Microsoft.Authorization/roleDefinitions",
+      "apiVersion": "2022-04-01",
+      "name": "5e0bd9bd-7b93-4f28-af87-19fc36ad61bd"
+    },
+    "cognitiveServiceOpenAIUserAccessFoundry": {
+      "type": "Microsoft.Authorization/roleAssignments",
+      "apiVersion": "2022-04-01",
+      "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', variables('aiFoundryAiServicesResourceName'))]",
+      "name": "[guid(take(format('avm.res.app.container-app.{0}', variables('containerAppResourceName')), 64), resourceId('Microsoft.CognitiveServices/accounts', variables('aiFoundryAiServicesResourceName')), resourceId('Microsoft.Authorization/roleDefinitions', '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd'))]",
+      "properties": {
+        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd')]",
+        "principalId": "[tryGet(tryGet(reference('containerApp').outputs, 'systemAssignedMIPrincipalId'), 'value')]"
+      },
+      "dependsOn": [
+        "aiFoundryAiServices",
+        "containerApp"
+      ]
+    },
+    "logAnalyticsWorkspace": {
+      "condition": "[and(variables('logAnalyticsWorkspaceEnabled'), not(variables('useExistingWorkspace')))]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[variables('logAnalyticsWorkspaceResourceName')]"
+          },
+          "tags": {
+            "value": "[coalesce(tryGet(parameters('logAnalyticsWorkspaceConfiguration'), 'tags'), parameters('tags'))]"
+          },
+          "location": {
+            "value": "[coalesce(tryGet(parameters('logAnalyticsWorkspaceConfiguration'), 'location'), parameters('solutionLocation'))]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "skuName": {
+            "value": "[coalesce(tryGet(parameters('logAnalyticsWorkspaceConfiguration'), 'sku'), 'PerGB2018')]"
+          },
+          "dataRetention": {
+            "value": "[coalesce(tryGet(parameters('logAnalyticsWorkspaceConfiguration'), 'dataRetentionInDays'), 365)]"
+          },
+          "diagnosticSettings": {
+            "value": [
+              {
+                "useThisWorkspace": true
+              }
+            ]
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.35.1.17967",
+              "templateHash": "10549387460031423688"
+            },
+            "name": "Log Analytics Workspaces",
+            "description": "This module deploys a Log Analytics Workspace."
+          },
+          "definitions": {
+            "diagnosticSettingType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of diagnostic setting."
+                  }
+                },
+                "logCategoriesAndGroups": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "category": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                        }
+                      },
+                      "categoryGroup": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                        }
+                      },
+                      "enabled": {
+                        "type": "bool",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                  }
+                },
+                "metricCategories": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "category": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                        }
+                      },
+                      "enabled": {
+                        "type": "bool",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                  }
+                },
+                "logAnalyticsDestinationType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "AzureDiagnostics",
+                    "Dedicated"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                  }
+                },
+                "useThisWorkspace": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Instead of using an external reference, use the deployed instance as the target for its diagnostic settings. If set to `true`, the `workspaceResourceId` property is ignored."
+                  }
+                },
+                "workspaceResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "storageAccountResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "eventHubAuthorizationRuleResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                  }
+                },
+                "eventHubName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "marketplacePartnerResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                  }
+                }
+              }
+            },
+            "gallerySolutionType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Name of the solution.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, the name should be in the pattern: `SolutionType[WorkspaceName]`, for example `MySolution[contoso-Logs]`.\nThe solution type is case-sensitive."
+                  }
+                },
+                "plan": {
+                  "$ref": "#/definitions/solutionPlanType",
+                  "metadata": {
+                    "description": "Required. Plan for solution object supported by the OperationsManagement resource provider."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "Properties of the gallery solutions to be created in the log analytics workspace."
+              }
+            },
+            "storageInsightsConfigType": {
+              "type": "object",
+              "properties": {
+                "storageAccountResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Resource ID of the storage account to be linked."
+                  }
+                },
+                "containers": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The names of the blob containers that the workspace should read."
+                  }
+                },
+                "tables": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. List of tables to be read by the workspace."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "Properties of the storage insights configuration."
+              }
+            },
+            "linkedServiceType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Name of the linked service."
+                  }
+                },
+                "resourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource id of the resource that will be linked to the workspace. This should be used for linking resources which require read access."
+                  }
+                },
+                "writeAccessResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource id of the resource that will be linked to the workspace. This should be used for linking resources which require write access."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "Properties of the linked service."
+              }
+            },
+            "linkedStorageAccountType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Name of the link."
+                  }
+                },
+                "storageAccountIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "minLength": 1,
+                  "metadata": {
+                    "description": "Required. Linked storage accounts resources Ids."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "Properties of the linked storage account."
+              }
+            },
+            "savedSearchType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Name of the saved search."
+                  }
+                },
+                "etag": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The ETag of the saved search. To override an existing saved search, use \"*\" or specify the current Etag."
+                  }
+                },
+                "category": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The category of the saved search. This helps the user to find a saved search faster."
+                  }
+                },
+                "displayName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Display name for the search."
+                  }
+                },
+                "functionAlias": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The function alias if query serves as a function."
+                  }
+                },
+                "functionParameters": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The optional function parameters if query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax please refer to /azure/kusto/query/functions/user-defined-functions."
+                  }
+                },
+                "query": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The query expression for the saved search."
+                  }
+                },
+                "tags": {
+                  "type": "array",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The tags attached to the saved search."
+                  }
+                },
+                "version": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The version number of the query language. The current version is 2 and is the default."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "Properties of the saved search."
+              }
+            },
+            "dataExportType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Name of the data export."
+                  }
+                },
+                "destination": {
+                  "$ref": "#/definitions/destinationType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The destination of the data export."
+                  }
+                },
+                "enable": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enable or disable the data export."
+                  }
+                },
+                "tableNames": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "metadata": {
+                    "description": "Required. The list of table names to export."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "Properties of the data export."
+              }
+            },
+            "dataSourceType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Name of the data source."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The kind of data source."
+                  }
+                },
+                "linkedResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource id of the resource that will be linked to the workspace."
+                  }
+                },
+                "eventLogName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the event log to configure when kind is WindowsEvent."
+                  }
+                },
+                "eventTypes": {
+                  "type": "array",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The event types to configure when kind is WindowsEvent."
+                  }
+                },
+                "objectName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Name of the object to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                  }
+                },
+                "instanceName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Name of the instance to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                  }
+                },
+                "intervalSeconds": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Interval in seconds to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                  }
+                },
+                "performanceCounters": {
+                  "type": "array",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. List of counters to configure when the kind is LinuxPerformanceObject."
+                  }
+                },
+                "counterName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Counter name to configure when kind is WindowsPerformanceCounter."
+                  }
+                },
+                "state": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. State to configure when kind is IISLogs or LinuxSyslogCollection or LinuxPerformanceCollection."
+                  }
+                },
+                "syslogName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. System log to configure when kind is LinuxSyslog."
+                  }
+                },
+                "syslogSeverities": {
+                  "type": "array",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Severities to configure when kind is LinuxSyslog."
+                  }
+                },
+                "tags": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Tags to configure in the resource."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "Properties of the data source."
+              }
+            },
+            "tableType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the table."
+                  }
+                },
+                "plan": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The plan for the table."
+                  }
+                },
+                "restoredLogs": {
+                  "$ref": "#/definitions/restoredLogsType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The restored logs for the table."
+                  }
+                },
+                "schema": {
+                  "$ref": "#/definitions/schemaType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The schema for the table."
+                  }
+                },
+                "searchResults": {
+                  "$ref": "#/definitions/searchResultsType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The search results for the table."
+                  }
+                },
+                "retentionInDays": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The retention in days for the table."
+                  }
+                },
+                "totalRetentionInDays": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The total retention in days for the table."
+                  }
+                },
+                "roleAssignments": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/roleAssignmentType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The role assignments for the table."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "Properties of the custom table."
+              }
+            },
+            "workspaceFeaturesType": {
+              "type": "object",
+              "properties": {
+                "disableLocalAuth": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Disable Non-EntraID based Auth. Default is true."
+                  }
+                },
+                "enableDataExport": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Flag that indicate if data should be exported."
+                  }
+                },
+                "enableLogAccessUsingOnlyResourcePermissions": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enable log access using only resource permissions. Default is false."
+                  }
+                },
+                "immediatePurgeDataOn30Days": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Flag that describes if we want to remove the data after 30 days."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "Features of the workspace."
+              }
+            },
+            "_1.columnType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The column name."
+                  }
+                },
+                "type": {
+                  "type": "string",
+                  "allowedValues": [
+                    "boolean",
+                    "dateTime",
+                    "dynamic",
+                    "guid",
+                    "int",
+                    "long",
+                    "real",
+                    "string"
+                  ],
+                  "metadata": {
+                    "description": "Required. The column type."
+                  }
+                },
+                "dataTypeHint": {
+                  "type": "string",
+                  "allowedValues": [
+                    "armPath",
+                    "guid",
+                    "ip",
+                    "uri"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The column data type logical hint."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The column description."
+                  }
+                },
+                "displayName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Column display name."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "The parameters of the table column.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "table/main.bicep"
+                }
+              }
+            },
+            "destinationType": {
+              "type": "object",
+              "properties": {
+                "resourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The destination resource ID."
+                  }
+                },
+                "metaData": {
+                  "type": "object",
+                  "properties": {
+                    "eventHubName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Allows to define an Event Hub name. Not applicable when destination is Storage Account."
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The destination metadata."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "The data export destination properties.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "data-export/main.bicep"
+                }
+              }
+            },
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a lock.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
+                }
+              }
+            },
+            "managedIdentityAllType": {
+              "type": "object",
+              "properties": {
+                "systemAssigned": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enables system assigned managed identity on the resource."
+                  }
+                },
+                "userAssignedResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
+                }
+              }
+            },
+            "restoredLogsType": {
+              "type": "object",
+              "properties": {
+                "sourceTable": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The table to restore data from."
+                  }
+                },
+                "startRestoreTime": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The timestamp to start the restore from (UTC)."
+                  }
+                },
+                "endRestoreTime": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The timestamp to end the restore by (UTC)."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "The parameters of the restore operation that initiated the table.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "table/main.bicep"
+                }
+              }
+            },
+            "roleAssignmentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                  }
+                },
+                "roleDefinitionIdOrName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                  }
+                },
+                "principalId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                  }
+                },
+                "principalType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Device",
+                    "ForeignGroup",
+                    "Group",
+                    "ServicePrincipal",
+                    "User"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The principal type of the assigned principal ID."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The description of the role assignment."
+                  }
+                },
+                "condition": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                  }
+                },
+                "conditionVersion": {
+                  "type": "string",
+                  "allowedValues": [
+                    "2.0"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Version of the condition."
+                  }
+                },
+                "delegatedManagedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a role assignment.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
+                }
+              }
+            },
+            "schemaType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The table name."
+                  }
+                },
+                "columns": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.columnType"
+                  },
+                  "metadata": {
+                    "description": "Required. A list of table custom columns."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The table description."
+                  }
+                },
+                "displayName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The table display name."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "The table schema.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "table/main.bicep"
+                }
+              }
+            },
+            "searchResultsType": {
+              "type": "object",
+              "properties": {
+                "query": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The search job query."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The search description."
+                  }
+                },
+                "limit": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Limit the search job to return up to specified number of rows."
+                  }
+                },
+                "startSearchTime": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The timestamp to start the search from (UTC)."
+                  }
+                },
+                "endSearchTime": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The timestamp to end the search by (UTC)."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "The parameters of the search job that initiated the table.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "table/main.bicep"
+                }
+              }
+            },
+            "solutionPlanType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Name of the solution to be created.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, it can be anything.\nThe solution type is case-sensitive.\nIf not provided, the value of the `name` parameter will be used."
+                  }
+                },
+                "product": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The product name of the deployed solution.\nFor Microsoft published gallery solution it should be `OMSGallery/{solutionType}`, for example `OMSGallery/AntiMalware`.\nFor a third party solution, it can be anything.\nThis is case sensitive."
+                  }
+                },
+                "publisher": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The publisher name of the deployed solution. For Microsoft published gallery solution, it is `Microsoft`, which is the default value."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/operations-management/solution:0.3.0"
+                }
+              }
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name of the Log Analytics workspace."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all resources."
+              }
+            },
+            "skuName": {
+              "type": "string",
+              "defaultValue": "PerGB2018",
+              "allowedValues": [
+                "CapacityReservation",
+                "Free",
+                "LACluster",
+                "PerGB2018",
+                "PerNode",
+                "Premium",
+                "Standalone",
+                "Standard"
+              ],
+              "metadata": {
+                "description": "Optional. The name of the SKU."
+              }
+            },
+            "skuCapacityReservationLevel": {
+              "type": "int",
+              "defaultValue": 100,
+              "minValue": 100,
+              "maxValue": 5000,
+              "metadata": {
+                "description": "Optional. The capacity reservation level in GB for this workspace, when CapacityReservation sku is selected. Must be in increments of 100 between 100 and 5000."
+              }
+            },
+            "storageInsightsConfigs": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/storageInsightsConfigType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. List of storage accounts to be read by the workspace."
+              }
+            },
+            "linkedServices": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/linkedServiceType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. List of services to be linked."
+              }
+            },
+            "linkedStorageAccounts": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/linkedStorageAccountType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Conditional. List of Storage Accounts to be linked. Required if 'forceCmkForQuery' is set to 'true' and 'savedSearches' is not empty."
+              }
+            },
+            "savedSearches": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/savedSearchType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Kusto Query Language searches to save."
+              }
+            },
+            "dataExports": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/dataExportType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. LAW data export instances to be deployed."
+              }
+            },
+            "dataSources": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/dataSourceType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. LAW data sources to configure."
+              }
+            },
+            "tables": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/tableType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. LAW custom tables to be deployed."
+              }
+            },
+            "gallerySolutions": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/gallerySolutionType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. List of gallerySolutions to be created in the log analytics workspace."
+              }
+            },
+            "onboardWorkspaceToSentinel": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Onboard the Log Analytics Workspace to Sentinel. Requires 'SecurityInsights' solution to be in gallerySolutions."
+              }
+            },
+            "dataRetention": {
+              "type": "int",
+              "defaultValue": 365,
+              "minValue": 0,
+              "maxValue": 730,
+              "metadata": {
+                "description": "Optional. Number of days data will be retained for."
+              }
+            },
+            "dailyQuotaGb": {
+              "type": "int",
+              "defaultValue": -1,
+              "minValue": -1,
+              "metadata": {
+                "description": "Optional. The workspace daily quota for ingestion."
+              }
+            },
+            "publicNetworkAccessForIngestion": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "allowedValues": [
+                "Enabled",
+                "Disabled"
+              ],
+              "metadata": {
+                "description": "Optional. The network access type for accessing Log Analytics ingestion."
+              }
+            },
+            "publicNetworkAccessForQuery": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "allowedValues": [
+                "Enabled",
+                "Disabled"
+              ],
+              "metadata": {
+                "description": "Optional. The network access type for accessing Log Analytics query."
+              }
+            },
+            "managedIdentities": {
+              "$ref": "#/definitions/managedIdentityAllType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The managed identity definition for this resource. Only one type of identity is supported: system-assigned or user-assigned, but not both."
+              }
+            },
+            "features": {
+              "$ref": "#/definitions/workspaceFeaturesType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The workspace features."
+              }
+            },
+            "diagnosticSettings": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/diagnosticSettingType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The diagnostic settings of the service."
+              }
+            },
+            "forceCmkForQuery": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Indicates whether customer managed storage is mandatory for query management."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "roleAssignments": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/roleAssignmentType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "formattedRoleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+              }
+            ],
+            "enableReferencedModulesTelemetry": false,
+            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), 'SystemAssigned', if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+            "builtInRoleNames": {
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Log Analytics Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '92aaf0da-9dab-42b6-94a3-d43ce8d16293')]",
+              "Log Analytics Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '73c42c96-874c-492b-b04d-ab87d138a893')]",
+              "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]",
+              "Monitoring Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '43d0d8ad-25c7-4714-9337-8ba259a9fe05')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "Security Admin": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fb1c8493-542b-48eb-b624-b4c8fea62acd')]",
+              "Security Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '39bc4728-0917-49c7-9d2c-d95423bc2eb4')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+            }
+          },
+          "resources": {
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.operationalinsights-workspace.{0}.{1}', replace('0.11.2', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "logAnalyticsWorkspace": {
+              "type": "Microsoft.OperationalInsights/workspaces",
+              "apiVersion": "2023-09-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "properties": {
+                "features": {
+                  "searchVersion": 1,
+                  "enableLogAccessUsingOnlyResourcePermissions": "[coalesce(tryGet(parameters('features'), 'enableLogAccessUsingOnlyResourcePermissions'), false())]",
+                  "disableLocalAuth": "[coalesce(tryGet(parameters('features'), 'disableLocalAuth'), true())]",
+                  "enableDataExport": "[tryGet(parameters('features'), 'enableDataExport')]",
+                  "immediatePurgeDataOn30Days": "[tryGet(parameters('features'), 'immediatePurgeDataOn30Days')]"
+                },
+                "sku": {
+                  "name": "[parameters('skuName')]",
+                  "capacityReservationLevel": "[if(equals(parameters('skuName'), 'CapacityReservation'), parameters('skuCapacityReservationLevel'), null())]"
+                },
+                "retentionInDays": "[parameters('dataRetention')]",
+                "workspaceCapping": {
+                  "dailyQuotaGb": "[parameters('dailyQuotaGb')]"
+                },
+                "publicNetworkAccessForIngestion": "[parameters('publicNetworkAccessForIngestion')]",
+                "publicNetworkAccessForQuery": "[parameters('publicNetworkAccessForQuery')]",
+                "forceCmkForQuery": "[parameters('forceCmkForQuery')]"
+              },
+              "identity": "[variables('identity')]"
+            },
+            "logAnalyticsWorkspace_diagnosticSettings": {
+              "copy": {
+                "name": "logAnalyticsWorkspace_diagnosticSettings",
+                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+              },
+              "type": "Microsoft.Insights/diagnosticSettings",
+              "apiVersion": "2021-05-01-preview",
+              "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "metrics",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                    "input": {
+                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                      "timeGrain": null
+                    }
+                  },
+                  {
+                    "name": "logs",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                    "input": {
+                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                    }
+                  }
+                ],
+                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                "workspaceId": "[if(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'useThisWorkspace'), false()), resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId'))]",
+                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+              },
+              "dependsOn": [
+                "logAnalyticsWorkspace"
+              ]
+            },
+            "logAnalyticsWorkspace_sentinelOnboarding": {
+              "condition": "[and(not(empty(filter(coalesce(parameters('gallerySolutions'), createArray()), lambda('item', startsWith(lambdaVariables('item').name, 'SecurityInsights'))))), parameters('onboardWorkspaceToSentinel'))]",
+              "type": "Microsoft.SecurityInsights/onboardingStates",
+              "apiVersion": "2024-03-01",
+              "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
+              "name": "default",
+              "properties": {},
+              "dependsOn": [
+                "logAnalyticsWorkspace"
+              ]
+            },
+            "logAnalyticsWorkspace_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "logAnalyticsWorkspace"
+              ]
+            },
+            "logAnalyticsWorkspace_roleAssignments": {
+              "copy": {
+                "name": "logAnalyticsWorkspace_roleAssignments",
+                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+              "properties": {
+                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "logAnalyticsWorkspace"
+              ]
+            },
+            "logAnalyticsWorkspace_storageInsightConfigs": {
+              "copy": {
+                "name": "logAnalyticsWorkspace_storageInsightConfigs",
+                "count": "[length(coalesce(parameters('storageInsightsConfigs'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-LAW-StorageInsightsConfig-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "logAnalyticsWorkspaceName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "containers": {
+                    "value": "[tryGet(coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()], 'containers')]"
+                  },
+                  "tables": {
+                    "value": "[tryGet(coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()], 'tables')]"
+                  },
+                  "storageAccountResourceId": {
+                    "value": "[coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()].storageAccountResourceId]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.35.1.17967",
+                      "templateHash": "2043978404537017691"
+                    },
+                    "name": "Log Analytics Workspace Storage Insight Configs",
+                    "description": "This module deploys a Log Analytics Workspace Storage Insight Config."
+                  },
+                  "parameters": {
+                    "logAnalyticsWorkspaceName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('{0}-stinsconfig', last(split(parameters('storageAccountResourceId'), '/')))]",
+                      "metadata": {
+                        "description": "Optional. The name of the storage insights config."
+                      }
+                    },
+                    "storageAccountResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The Azure Resource Manager ID of the storage account resource."
+                      }
+                    },
+                    "containers": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The names of the blob containers that the workspace should read."
+                      }
+                    },
+                    "tables": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The names of the Azure tables that the workspace should read."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags to configure in the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "storageAccount": {
+                      "existing": true,
+                      "type": "Microsoft.Storage/storageAccounts",
+                      "apiVersion": "2022-09-01",
+                      "name": "[last(split(parameters('storageAccountResourceId'), '/'))]"
+                    },
+                    "workspace": {
+                      "existing": true,
+                      "type": "Microsoft.OperationalInsights/workspaces",
+                      "apiVersion": "2023-09-01",
+                      "name": "[parameters('logAnalyticsWorkspaceName')]"
+                    },
+                    "storageinsightconfig": {
+                      "type": "Microsoft.OperationalInsights/workspaces/storageInsightConfigs",
+                      "apiVersion": "2023-09-01",
+                      "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "containers": "[parameters('containers')]",
+                        "tables": "[parameters('tables')]",
+                        "storageAccount": {
+                          "id": "[parameters('storageAccountResourceId')]",
+                          "key": "[listKeys('storageAccount', '2022-09-01').keys[0].value]"
+                        }
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed storage insights configuration."
+                      },
+                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces/storageInsightConfigs', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group where the storage insight configuration is deployed."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the storage insights configuration."
+                      },
+                      "value": "[parameters('name')]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "logAnalyticsWorkspace"
+              ]
+            },
+            "logAnalyticsWorkspace_linkedServices": {
+              "copy": {
+                "name": "logAnalyticsWorkspace_linkedServices",
+                "count": "[length(coalesce(parameters('linkedServices'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-LAW-LinkedService-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "logAnalyticsWorkspaceName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('linkedServices'), createArray())[copyIndex()].name]"
+                  },
+                  "resourceId": {
+                    "value": "[tryGet(coalesce(parameters('linkedServices'), createArray())[copyIndex()], 'resourceId')]"
+                  },
+                  "writeAccessResourceId": {
+                    "value": "[tryGet(coalesce(parameters('linkedServices'), createArray())[copyIndex()], 'writeAccessResourceId')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.35.1.17967",
+                      "templateHash": "15624488954958814427"
+                    },
+                    "name": "Log Analytics Workspace Linked Services",
+                    "description": "This module deploys a Log Analytics Workspace Linked Service."
+                  },
+                  "parameters": {
+                    "logAnalyticsWorkspaceName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the link."
+                      }
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resource ID of the resource that will be linked to the workspace. This should be used for linking resources which require read access."
+                      }
+                    },
+                    "writeAccessResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resource ID of the resource that will be linked to the workspace. This should be used for linking resources which require write access."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags to configure in the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "workspace": {
+                      "existing": true,
+                      "type": "Microsoft.OperationalInsights/workspaces",
+                      "apiVersion": "2023-09-01",
+                      "name": "[parameters('logAnalyticsWorkspaceName')]"
+                    },
+                    "linkedService": {
+                      "type": "Microsoft.OperationalInsights/workspaces/linkedServices",
+                      "apiVersion": "2023-09-01",
+                      "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "resourceId": "[parameters('resourceId')]",
+                        "writeAccessResourceId": "[parameters('writeAccessResourceId')]"
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed linked service."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed linked service."
+                      },
+                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces/linkedServices', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group where the linked service is deployed."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "logAnalyticsWorkspace"
+              ]
+            },
+            "logAnalyticsWorkspace_linkedStorageAccounts": {
+              "copy": {
+                "name": "logAnalyticsWorkspace_linkedStorageAccounts",
+                "count": "[length(coalesce(parameters('linkedStorageAccounts'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-LAW-LinkedStorageAccount-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "logAnalyticsWorkspaceName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('linkedStorageAccounts'), createArray())[copyIndex()].name]"
+                  },
+                  "storageAccountIds": {
+                    "value": "[coalesce(parameters('linkedStorageAccounts'), createArray())[copyIndex()].storageAccountIds]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.35.1.17967",
+                      "templateHash": "8250559094478594611"
+                    },
+                    "name": "Log Analytics Workspace Linked Storage Accounts",
+                    "description": "This module deploys a Log Analytics Workspace Linked Storage Account."
+                  },
+                  "parameters": {
+                    "logAnalyticsWorkspaceName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "allowedValues": [
+                        "Query",
+                        "Alerts",
+                        "CustomLogs",
+                        "AzureWatson"
+                      ],
+                      "metadata": {
+                        "description": "Required. Name of the link."
+                      }
+                    },
+                    "storageAccountIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "minLength": 1,
+                      "metadata": {
+                        "description": "Required. Linked storage accounts resources Ids."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "workspace": {
+                      "existing": true,
+                      "type": "Microsoft.OperationalInsights/workspaces",
+                      "apiVersion": "2023-09-01",
+                      "name": "[parameters('logAnalyticsWorkspaceName')]"
+                    },
+                    "linkedStorageAccount": {
+                      "type": "Microsoft.OperationalInsights/workspaces/linkedStorageAccounts",
+                      "apiVersion": "2023-09-01",
+                      "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                      "properties": {
+                        "storageAccountIds": "[parameters('storageAccountIds')]"
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed linked storage account."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed linked storage account."
+                      },
+                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces/linkedStorageAccounts', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group where the linked storage account is deployed."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "logAnalyticsWorkspace"
+              ]
+            },
+            "logAnalyticsWorkspace_savedSearches": {
+              "copy": {
+                "name": "logAnalyticsWorkspace_savedSearches",
+                "count": "[length(coalesce(parameters('savedSearches'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-LAW-SavedSearch-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "logAnalyticsWorkspaceName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[format('{0}{1}', coalesce(parameters('savedSearches'), createArray())[copyIndex()].name, uniqueString(deployment().name))]"
+                  },
+                  "etag": {
+                    "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'etag')]"
+                  },
+                  "displayName": {
+                    "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].displayName]"
+                  },
+                  "category": {
+                    "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].category]"
+                  },
+                  "query": {
+                    "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].query]"
+                  },
+                  "functionAlias": {
+                    "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'functionAlias')]"
+                  },
+                  "functionParameters": {
+                    "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'functionParameters')]"
+                  },
+                  "tags": {
+                    "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'tags')]"
+                  },
+                  "version": {
+                    "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'version')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.35.1.17967",
+                      "templateHash": "5149844663841891327"
+                    },
+                    "name": "Log Analytics Workspace Saved Searches",
+                    "description": "This module deploys a Log Analytics Workspace Saved Search."
+                  },
+                  "parameters": {
+                    "logAnalyticsWorkspaceName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the saved search."
+                      }
+                    },
+                    "displayName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Display name for the search."
+                      }
+                    },
+                    "category": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Query category."
+                      }
+                    },
+                    "query": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Kusto Query to be stored."
+                      }
+                    },
+                    "tags": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags to configure in the resource."
+                      }
+                    },
+                    "functionAlias": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. The function alias if query serves as a function."
+                      }
+                    },
+                    "functionParameters": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. The optional function parameters if query serves as a function. Value should be in the following format: \"param-name1:type1 = default_value1, param-name2:type2 = default_value2\". For more examples and proper syntax please refer to /azure/kusto/query/functions/user-defined-functions."
+                      }
+                    },
+                    "version": {
+                      "type": "int",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The version number of the query language."
+                      }
+                    },
+                    "etag": {
+                      "type": "string",
+                      "defaultValue": "*",
+                      "metadata": {
+                        "description": "Optional. The ETag of the saved search. To override an existing saved search, use \"*\" or specify the current Etag."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "workspace": {
+                      "existing": true,
+                      "type": "Microsoft.OperationalInsights/workspaces",
+                      "apiVersion": "2023-09-01",
+                      "name": "[parameters('logAnalyticsWorkspaceName')]"
+                    },
+                    "savedSearch": {
+                      "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
+                      "apiVersion": "2023-09-01",
+                      "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                      "properties": {
+                        "etag": "[parameters('etag')]",
+                        "tags": "[coalesce(parameters('tags'), createArray())]",
+                        "displayName": "[parameters('displayName')]",
+                        "category": "[parameters('category')]",
+                        "query": "[parameters('query')]",
+                        "functionAlias": "[parameters('functionAlias')]",
+                        "functionParameters": "[parameters('functionParameters')]",
+                        "version": "[parameters('version')]"
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed saved search."
+                      },
+                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group where the saved search is deployed."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed saved search."
+                      },
+                      "value": "[parameters('name')]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "logAnalyticsWorkspace",
+                "logAnalyticsWorkspace_linkedStorageAccounts"
+              ]
+            },
+            "logAnalyticsWorkspace_dataExports": {
+              "copy": {
+                "name": "logAnalyticsWorkspace_dataExports",
+                "count": "[length(coalesce(parameters('dataExports'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-LAW-DataExport-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "workspaceName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('dataExports'), createArray())[copyIndex()].name]"
+                  },
+                  "destination": {
+                    "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'destination')]"
+                  },
+                  "enable": {
+                    "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'enable')]"
+                  },
+                  "tableNames": {
+                    "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'tableNames')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.35.1.17967",
+                      "templateHash": "1695158270142527557"
+                    },
+                    "name": "Log Analytics Workspace Data Exports",
+                    "description": "This module deploys a Log Analytics Workspace Data Export."
+                  },
+                  "definitions": {
+                    "destinationType": {
+                      "type": "object",
+                      "properties": {
+                        "resourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The destination resource ID."
+                          }
+                        },
+                        "metaData": {
+                          "type": "object",
+                          "properties": {
+                            "eventHubName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Allows to define an Event Hub name. Not applicable when destination is Storage Account."
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The destination metadata."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The data export destination properties."
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "minLength": 4,
+                      "maxLength": 63,
+                      "metadata": {
+                        "description": "Required. The data export rule name."
+                      }
+                    },
+                    "workspaceName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent workspaces. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "destination": {
+                      "$ref": "#/definitions/destinationType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Destination properties."
+                      }
+                    },
+                    "enable": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Active when enabled."
+                      }
+                    },
+                    "tableNames": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "minLength": 1,
+                      "metadata": {
+                        "description": "Required. An array of tables to export, for example: ['Heartbeat', 'SecurityEvent']."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "workspace": {
+                      "existing": true,
+                      "type": "Microsoft.OperationalInsights/workspaces",
+                      "apiVersion": "2023-09-01",
+                      "name": "[parameters('workspaceName')]"
+                    },
+                    "dataExport": {
+                      "type": "Microsoft.OperationalInsights/workspaces/dataExports",
+                      "apiVersion": "2023-09-01",
+                      "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('name'))]",
+                      "properties": {
+                        "destination": "[parameters('destination')]",
+                        "enable": "[parameters('enable')]",
+                        "tableNames": "[parameters('tableNames')]"
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the data export."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the data export."
+                      },
+                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces/dataExports', parameters('workspaceName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the data export was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "logAnalyticsWorkspace"
+              ]
+            },
+            "logAnalyticsWorkspace_dataSources": {
+              "copy": {
+                "name": "logAnalyticsWorkspace_dataSources",
+                "count": "[length(coalesce(parameters('dataSources'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-LAW-DataSource-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "logAnalyticsWorkspaceName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('dataSources'), createArray())[copyIndex()].name]"
+                  },
+                  "kind": {
+                    "value": "[coalesce(parameters('dataSources'), createArray())[copyIndex()].kind]"
+                  },
+                  "linkedResourceId": {
+                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'linkedResourceId')]"
+                  },
+                  "eventLogName": {
+                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'eventLogName')]"
+                  },
+                  "eventTypes": {
+                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'eventTypes')]"
+                  },
+                  "objectName": {
+                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'objectName')]"
+                  },
+                  "instanceName": {
+                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'instanceName')]"
+                  },
+                  "intervalSeconds": {
+                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'intervalSeconds')]"
+                  },
+                  "counterName": {
+                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'counterName')]"
+                  },
+                  "state": {
+                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'state')]"
+                  },
+                  "syslogName": {
+                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'syslogName')]"
+                  },
+                  "syslogSeverities": {
+                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'syslogSeverities')]"
+                  },
+                  "performanceCounters": {
+                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'performanceCounters')]"
+                  },
+                  "tags": {
+                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'tags')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.35.1.17967",
+                      "templateHash": "3062149733782372246"
+                    },
+                    "name": "Log Analytics Workspace Datasources",
+                    "description": "This module deploys a Log Analytics Workspace Data Source."
+                  },
+                  "parameters": {
+                    "logAnalyticsWorkspaceName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the data source."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "defaultValue": "AzureActivityLog",
+                      "allowedValues": [
+                        "AzureActivityLog",
+                        "WindowsEvent",
+                        "WindowsPerformanceCounter",
+                        "IISLogs",
+                        "LinuxSyslog",
+                        "LinuxSyslogCollection",
+                        "LinuxPerformanceObject",
+                        "LinuxPerformanceCollection"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The kind of the data source."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags to configure in the resource."
+                      }
+                    },
+                    "linkedResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Resource ID of the resource to be linked."
+                      }
+                    },
+                    "eventLogName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Windows event log name to configure when kind is WindowsEvent."
+                      }
+                    },
+                    "eventTypes": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Windows event types to configure when kind is WindowsEvent."
+                      }
+                    },
+                    "objectName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Name of the object to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                      }
+                    },
+                    "instanceName": {
+                      "type": "string",
+                      "defaultValue": "*",
+                      "metadata": {
+                        "description": "Optional. Name of the instance to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                      }
+                    },
+                    "intervalSeconds": {
+                      "type": "int",
+                      "defaultValue": 60,
+                      "metadata": {
+                        "description": "Optional. Interval in seconds to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                      }
+                    },
+                    "performanceCounters": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. List of counters to configure when the kind is LinuxPerformanceObject."
+                      }
+                    },
+                    "counterName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Counter name to configure when kind is WindowsPerformanceCounter."
+                      }
+                    },
+                    "state": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. State to configure when kind is IISLogs or LinuxSyslogCollection or LinuxPerformanceCollection."
+                      }
+                    },
+                    "syslogName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. System log to configure when kind is LinuxSyslog."
+                      }
+                    },
+                    "syslogSeverities": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Severities to configure when kind is LinuxSyslog."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "workspace": {
+                      "existing": true,
+                      "type": "Microsoft.OperationalInsights/workspaces",
+                      "apiVersion": "2023-09-01",
+                      "name": "[parameters('logAnalyticsWorkspaceName')]"
+                    },
+                    "dataSource": {
+                      "type": "Microsoft.OperationalInsights/workspaces/dataSources",
+                      "apiVersion": "2023-09-01",
+                      "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                      "kind": "[parameters('kind')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "linkedResourceId": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'AzureActivityLog')), parameters('linkedResourceId'), null())]",
+                        "eventLogName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsEvent')), parameters('eventLogName'), null())]",
+                        "eventTypes": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsEvent')), parameters('eventTypes'), null())]",
+                        "objectName": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('objectName'), null())]",
+                        "instanceName": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('instanceName'), null())]",
+                        "intervalSeconds": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('intervalSeconds'), null())]",
+                        "counterName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsPerformanceCounter')), parameters('counterName'), null())]",
+                        "state": "[if(and(not(empty(parameters('kind'))), or(or(equals(parameters('kind'), 'IISLogs'), equals(parameters('kind'), 'LinuxSyslogCollection')), equals(parameters('kind'), 'LinuxPerformanceCollection'))), parameters('state'), null())]",
+                        "syslogName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'LinuxSyslog')), parameters('syslogName'), null())]",
+                        "syslogSeverities": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'LinuxSyslog'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('syslogSeverities'), null())]",
+                        "performanceCounters": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'LinuxPerformanceObject')), parameters('performanceCounters'), null())]"
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed data source."
+                      },
+                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces/dataSources', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group where the data source is deployed."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed data source."
+                      },
+                      "value": "[parameters('name')]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "logAnalyticsWorkspace"
+              ]
+            },
+            "logAnalyticsWorkspace_tables": {
+              "copy": {
+                "name": "logAnalyticsWorkspace_tables",
+                "count": "[length(coalesce(parameters('tables'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-LAW-Table-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "workspaceName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('tables'), createArray())[copyIndex()].name]"
+                  },
+                  "plan": {
+                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'plan')]"
+                  },
+                  "schema": {
+                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'schema')]"
+                  },
+                  "retentionInDays": {
+                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'retentionInDays')]"
+                  },
+                  "totalRetentionInDays": {
+                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'totalRetentionInDays')]"
+                  },
+                  "restoredLogs": {
+                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'restoredLogs')]"
+                  },
+                  "searchResults": {
+                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'searchResults')]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.35.1.17967",
+                      "templateHash": "5855172714151847939"
+                    },
+                    "name": "Log Analytics Workspace Tables",
+                    "description": "This module deploys a Log Analytics Workspace Table."
+                  },
+                  "definitions": {
+                    "restoredLogsType": {
+                      "type": "object",
+                      "properties": {
+                        "sourceTable": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The table to restore data from."
+                          }
+                        },
+                        "startRestoreTime": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The timestamp to start the restore from (UTC)."
+                          }
+                        },
+                        "endRestoreTime": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The timestamp to end the restore by (UTC)."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The parameters of the restore operation that initiated the table."
+                      }
+                    },
+                    "schemaType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The table name."
+                          }
+                        },
+                        "columns": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/columnType"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of table custom columns."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The table description."
+                          }
+                        },
+                        "displayName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The table display name."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The table schema."
+                      }
+                    },
+                    "columnType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The column name."
+                          }
+                        },
+                        "type": {
+                          "type": "string",
+                          "allowedValues": [
+                            "boolean",
+                            "dateTime",
+                            "dynamic",
+                            "guid",
+                            "int",
+                            "long",
+                            "real",
+                            "string"
+                          ],
+                          "metadata": {
+                            "description": "Required. The column type."
+                          }
+                        },
+                        "dataTypeHint": {
+                          "type": "string",
+                          "allowedValues": [
+                            "armPath",
+                            "guid",
+                            "ip",
+                            "uri"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The column data type logical hint."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The column description."
+                          }
+                        },
+                        "displayName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Column display name."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The parameters of the table column."
+                      }
+                    },
+                    "searchResultsType": {
+                      "type": "object",
+                      "properties": {
+                        "query": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The search job query."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The search description."
+                          }
+                        },
+                        "limit": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Limit the search job to return up to specified number of rows."
+                          }
+                        },
+                        "startSearchTime": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The timestamp to start the search from (UTC)."
+                          }
+                        },
+                        "endSearchTime": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The timestamp to end the search by (UTC)."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The parameters of the search job that initiated the table."
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the table."
+                      }
+                    },
+                    "workspaceName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent workspaces. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "plan": {
+                      "type": "string",
+                      "defaultValue": "Analytics",
+                      "allowedValues": [
+                        "Basic",
+                        "Analytics"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Instruct the system how to handle and charge the logs ingested to this table."
+                      }
+                    },
+                    "restoredLogs": {
+                      "$ref": "#/definitions/restoredLogsType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Restore parameters."
+                      }
+                    },
+                    "retentionInDays": {
+                      "type": "int",
+                      "defaultValue": -1,
+                      "minValue": -1,
+                      "maxValue": 730,
+                      "metadata": {
+                        "description": "Optional. The table retention in days, between 4 and 730. Setting this property to -1 will default to the workspace retention."
+                      }
+                    },
+                    "schema": {
+                      "$ref": "#/definitions/schemaType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Table's schema."
+                      }
+                    },
+                    "searchResults": {
+                      "$ref": "#/definitions/searchResultsType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Parameters of the search job that initiated this table."
+                      }
+                    },
+                    "totalRetentionInDays": {
+                      "type": "int",
+                      "defaultValue": -1,
+                      "minValue": -1,
+                      "maxValue": 2555,
+                      "metadata": {
+                        "description": "Optional. The table total retention in days, between 4 and 2555. Setting this property to -1 will default to table retention."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Log Analytics Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '92aaf0da-9dab-42b6-94a3-d43ce8d16293')]",
+                      "Log Analytics Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '73c42c96-874c-492b-b04d-ab87d138a893')]",
+                      "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]",
+                      "Monitoring Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '43d0d8ad-25c7-4714-9337-8ba259a9fe05')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "workspace": {
+                      "existing": true,
+                      "type": "Microsoft.OperationalInsights/workspaces",
+                      "apiVersion": "2023-09-01",
+                      "name": "[parameters('workspaceName')]"
+                    },
+                    "table": {
+                      "type": "Microsoft.OperationalInsights/workspaces/tables",
+                      "apiVersion": "2023-09-01",
+                      "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('name'))]",
+                      "properties": {
+                        "plan": "[parameters('plan')]",
+                        "restoredLogs": "[parameters('restoredLogs')]",
+                        "retentionInDays": "[parameters('retentionInDays')]",
+                        "schema": "[parameters('schema')]",
+                        "searchResults": "[parameters('searchResults')]",
+                        "totalRetentionInDays": "[parameters('totalRetentionInDays')]"
+                      }
+                    },
+                    "table_roleAssignments": {
+                      "copy": {
+                        "name": "table_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}/tables/{1}', parameters('workspaceName'), parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "table"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the table."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the table."
+                      },
+                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the table was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "logAnalyticsWorkspace"
+              ]
+            },
+            "logAnalyticsWorkspace_solutions": {
+              "copy": {
+                "name": "logAnalyticsWorkspace_solutions",
+                "count": "[length(coalesce(parameters('gallerySolutions'), createArray()))]"
+              },
+              "condition": "[not(empty(parameters('gallerySolutions')))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-LAW-Solution-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[coalesce(parameters('gallerySolutions'), createArray())[copyIndex()].name]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "logAnalyticsWorkspaceName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "plan": {
+                    "value": "[coalesce(parameters('gallerySolutions'), createArray())[copyIndex()].plan]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.30.23.60470",
+                      "templateHash": "1867653058254938383"
+                    },
+                    "name": "Operations Management Solutions",
+                    "description": "This module deploys an Operations Management Solution.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "solutionPlanType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the solution to be created.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, it can be anything.\nThe solution type is case-sensitive.\nIf not provided, the value of the `name` parameter will be used."
+                          }
+                        },
+                        "product": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The product name of the deployed solution.\nFor Microsoft published gallery solution it should be `OMSGallery/{solutionType}`, for example `OMSGallery/AntiMalware`.\nFor a third party solution, it can be anything.\nThis is case sensitive."
+                          }
+                        },
+                        "publisher": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The publisher name of the deployed solution. For Microsoft published gallery solution, it is `Microsoft`, which is the default value."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the solution.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, the name should be in the pattern: `SolutionType[WorkspaceName]`, for example `MySolution[contoso-Logs]`.\nThe solution type is case-sensitive."
+                      }
+                    },
+                    "plan": {
+                      "$ref": "#/definitions/solutionPlanType",
+                      "metadata": {
+                        "description": "Required. Plan for solution object supported by the OperationsManagement resource provider."
+                      }
+                    },
+                    "logAnalyticsWorkspaceName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the Log Analytics workspace where the solution will be deployed/enabled."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.operationsmanagement-solution.{0}.{1}', replace('0.3.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "logAnalyticsWorkspace": {
+                      "existing": true,
+                      "type": "Microsoft.OperationalInsights/workspaces",
+                      "apiVersion": "2021-06-01",
+                      "name": "[parameters('logAnalyticsWorkspaceName')]"
+                    },
+                    "solution": {
+                      "type": "Microsoft.OperationsManagement/solutions",
+                      "apiVersion": "2015-11-01-preview",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "properties": {
+                        "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsWorkspaceName'))]"
+                      },
+                      "plan": {
+                        "name": "[coalesce(tryGet(parameters('plan'), 'name'), parameters('name'))]",
+                        "promotionCode": "",
+                        "product": "[parameters('plan').product]",
+                        "publisher": "[coalesce(tryGet(parameters('plan'), 'publisher'), 'Microsoft')]"
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed solution."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed solution."
+                      },
+                      "value": "[resourceId('Microsoft.OperationsManagement/solutions', parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group where the solution is deployed."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('solution', '2015-11-01-preview', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "logAnalyticsWorkspace"
+              ]
+            }
+          },
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the deployed log analytics workspace."
+              },
+              "value": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('name'))]"
+            },
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group of the deployed log analytics workspace."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the deployed log analytics workspace."
+              },
+              "value": "[parameters('name')]"
+            },
+            "logAnalyticsWorkspaceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The ID associated with the workspace."
+              },
+              "value": "[reference('logAnalyticsWorkspace').customerId]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('logAnalyticsWorkspace', '2023-09-01', 'full').location]"
+            },
+            "systemAssignedMIPrincipalId": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "The principal ID of the system assigned identity."
+              },
+              "value": "[tryGet(tryGet(reference('logAnalyticsWorkspace', '2023-09-01', 'full'), 'identity'), 'principalId')]"
+            },
+            "primarySharedKey": {
+              "type": "securestring",
+              "metadata": {
+                "description": "The primary shared key of the log analytics workspace."
+              },
+              "value": "[listKeys('logAnalyticsWorkspace', '2023-09-01').primarySharedKey]"
+            },
+            "secondarySharedKey": {
+              "type": "securestring",
+              "metadata": {
+                "description": "The secondary shared key of the log analytics workspace."
+              },
+              "value": "[listKeys('logAnalyticsWorkspace', '2023-09-01').secondarySharedKey]"
+            }
+          }
+        }
+      }
+    },
+    "applicationInsights": {
+      "condition": "[variables('applicationInsightsEnabled')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('avm.res.insights.component.{0}', variables('applicationInsightsResourceName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[variables('applicationInsightsResourceName')]"
+          },
+          "workspaceResourceId": "[if(variables('useExistingWorkspace'), createObject('value', variables('existingWorkspaceResourceId')), createObject('value', listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId))]",
+          "location": {
+            "value": "[coalesce(tryGet(parameters('applicationInsightsConfiguration'), 'location'), parameters('solutionLocation'))]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "tags": {
+            "value": "[coalesce(tryGet(parameters('applicationInsightsConfiguration'), 'tags'), parameters('tags'))]"
+          },
+          "retentionInDays": {
+            "value": "[coalesce(tryGet(parameters('applicationInsightsConfiguration'), 'retentionInDays'), 365)]"
+          },
+          "diagnosticSettings": {
+            "value": [
+              {
+                "workspaceResourceId": "[if(variables('useExistingWorkspace'), variables('existingWorkspaceResourceId'), listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId)]"
+              }
+            ]
+          },
+          "kind": {
+            "value": "web"
+          },
+          "disableIpMasking": {
+            "value": false
+          },
+          "flowType": {
+            "value": "Bluefield"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.33.93.31351",
+              "templateHash": "5735496719243704506"
+            },
+            "name": "Application Insights",
+            "description": "This component deploys an Application Insights instance."
+          },
+          "definitions": {
+            "diagnosticSettingFullType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the diagnostic setting."
+                  }
+                },
+                "logCategoriesAndGroups": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "category": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                        }
+                      },
+                      "categoryGroup": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                        }
+                      },
+                      "enabled": {
+                        "type": "bool",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                  }
+                },
+                "metricCategories": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "category": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                        }
+                      },
+                      "enabled": {
+                        "type": "bool",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                  }
+                },
+                "logAnalyticsDestinationType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "AzureDiagnostics",
+                    "Dedicated"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                  }
+                },
+                "workspaceResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "storageAccountResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "eventHubAuthorizationRuleResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                  }
+                },
+                "eventHubName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "marketplacePartnerResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.3.0"
+                }
+              }
+            },
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a lock.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "roleAssignmentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                  }
+                },
+                "roleDefinitionIdOrName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                  }
+                },
+                "principalId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                  }
+                },
+                "principalType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Device",
+                    "ForeignGroup",
+                    "Group",
+                    "ServicePrincipal",
+                    "User"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The principal type of the assigned principal ID."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The description of the role assignment."
+                  }
+                },
+                "condition": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                  }
+                },
+                "conditionVersion": {
+                  "type": "string",
+                  "allowedValues": [
+                    "2.0"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Version of the condition."
+                  }
+                },
+                "delegatedManagedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a role assignment.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.3.0"
+                }
+              }
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name of the Application Insights."
+              }
+            },
+            "applicationType": {
+              "type": "string",
+              "defaultValue": "web",
+              "allowedValues": [
+                "web",
+                "other"
+              ],
+              "metadata": {
+                "description": "Optional. Application type."
+              }
+            },
+            "workspaceResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Resource ID of the log analytics workspace which the data will be ingested to. This property is required to create an application with this API version. Applications from older versions will not have this property."
+              }
+            },
+            "disableIpMasking": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Disable IP masking. Default value is set to true."
+              }
+            },
+            "disableLocalAuth": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Disable Non-AAD based Auth. Default value is set to false."
+              }
+            },
+            "forceCustomerStorageForProfiler": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Force users to create their own storage account for profiler and debugger."
+              }
+            },
+            "linkedStorageAccountResourceId": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Linked storage account resource ID."
+              }
+            },
+            "publicNetworkAccessForIngestion": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "allowedValues": [
+                "Enabled",
+                "Disabled"
+              ],
+              "metadata": {
+                "description": "Optional. The network access type for accessing Application Insights ingestion. - Enabled or Disabled."
+              }
+            },
+            "publicNetworkAccessForQuery": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "allowedValues": [
+                "Enabled",
+                "Disabled"
+              ],
+              "metadata": {
+                "description": "Optional. The network access type for accessing Application Insights query. - Enabled or Disabled."
+              }
+            },
+            "retentionInDays": {
+              "type": "int",
+              "defaultValue": 365,
+              "allowedValues": [
+                30,
+                60,
+                90,
+                120,
+                180,
+                270,
+                365,
+                550,
+                730
+              ],
+              "metadata": {
+                "description": "Optional. Retention period in days."
+              }
+            },
+            "samplingPercentage": {
+              "type": "int",
+              "defaultValue": 100,
+              "minValue": 0,
+              "maxValue": 100,
+              "metadata": {
+                "description": "Optional. Percentage of the data produced by the application being monitored that is being sampled for Application Insights telemetry."
+              }
+            },
+            "flowType": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Used by the Application Insights system to determine what kind of flow this component was created by. This is to be set to 'Bluefield' when creating/updating a component via the REST API."
+              }
+            },
+            "requestSource": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Describes what tool created this Application Insights component. Customers using this API should set this to the default 'rest'."
+              }
+            },
+            "kind": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. The kind of application that this component refers to, used to customize UI. This value is a freeform string, values should typically be one of the following: web, ios, other, store, java, phone."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all Resources."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "roleAssignments": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/roleAssignmentType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "diagnosticSettings": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/diagnosticSettingFullType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The diagnostic settings of the service."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "formattedRoleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+              }
+            ],
+            "builtInRoleNames": {
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+              "Monitoring Metrics Publisher": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3913510d-42f4-4e42-8a64-420c390055eb')]",
+              "Application Insights Component Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ae349356-3a1b-4a5e-921d-050484c6347e')]",
+              "Application Insights Snapshot Debugger": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '08954f03-6346-4c2e-81c0-ec3a5cfae23b')]",
+              "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]"
+            }
+          },
+          "resources": {
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.insights-component.{0}.{1}', replace('0.6.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "appInsights": {
+              "type": "Microsoft.Insights/components",
+              "apiVersion": "2020-02-02",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "kind": "[parameters('kind')]",
+              "properties": {
+                "Application_Type": "[parameters('applicationType')]",
+                "DisableIpMasking": "[parameters('disableIpMasking')]",
+                "DisableLocalAuth": "[parameters('disableLocalAuth')]",
+                "ForceCustomerStorageForProfiler": "[parameters('forceCustomerStorageForProfiler')]",
+                "WorkspaceResourceId": "[parameters('workspaceResourceId')]",
+                "publicNetworkAccessForIngestion": "[parameters('publicNetworkAccessForIngestion')]",
+                "publicNetworkAccessForQuery": "[parameters('publicNetworkAccessForQuery')]",
+                "RetentionInDays": "[parameters('retentionInDays')]",
+                "SamplingPercentage": "[parameters('samplingPercentage')]",
+                "Flow_Type": "[parameters('flowType')]",
+                "Request_Source": "[parameters('requestSource')]"
+              }
+            },
+            "appInsights_roleAssignments": {
+              "copy": {
+                "name": "appInsights_roleAssignments",
+                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Insights/components', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+              "properties": {
+                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "appInsights"
+              ]
+            },
+            "appInsights_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "appInsights"
+              ]
+            },
+            "appInsights_diagnosticSettings": {
+              "copy": {
+                "name": "appInsights_diagnosticSettings",
+                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+              },
+              "type": "Microsoft.Insights/diagnosticSettings",
+              "apiVersion": "2021-05-01-preview",
+              "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "metrics",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                    "input": {
+                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                      "timeGrain": null
+                    }
+                  },
+                  {
+                    "name": "logs",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                    "input": {
+                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                    }
+                  }
+                ],
+                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+              },
+              "dependsOn": [
+                "appInsights"
+              ]
+            },
+            "linkedStorageAccount": {
+              "condition": "[not(empty(parameters('linkedStorageAccountResourceId')))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-appInsights-linkedStorageAccount', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "appInsightsName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "storageAccountResourceId": {
+                    "value": "[coalesce(parameters('linkedStorageAccountResourceId'), '')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.33.93.31351",
+                      "templateHash": "10861379689695100897"
+                    },
+                    "name": "Application Insights Linked Storage Account",
+                    "description": "This component deploys an Application Insights Linked Storage Account."
+                  },
+                  "parameters": {
+                    "appInsightsName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Application Insights instance. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "storageAccountResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Linked storage account resource ID."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "microsoft.insights/components/linkedStorageAccounts",
+                      "apiVersion": "2020-03-01-preview",
+                      "name": "[format('{0}/{1}', parameters('appInsightsName'), 'ServiceProfiler')]",
+                      "properties": {
+                        "linkedStorageAccount": "[parameters('storageAccountResourceId')]"
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Linked Storage Account."
+                      },
+                      "value": "ServiceProfiler"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the Linked Storage Account."
+                      },
+                      "value": "[resourceId('microsoft.insights/components/linkedStorageAccounts', parameters('appInsightsName'), 'ServiceProfiler')]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the agent pool was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "appInsights"
+              ]
+            }
+          },
+          "outputs": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the application insights component."
+              },
+              "value": "[parameters('name')]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the application insights component."
+              },
+              "value": "[resourceId('Microsoft.Insights/components', parameters('name'))]"
+            },
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group the application insights component was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "applicationId": {
+              "type": "string",
+              "metadata": {
+                "description": "The application ID of the application insights component."
+              },
+              "value": "[reference('appInsights').AppId]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('appInsights', '2020-02-02', 'full').location]"
+            },
+            "instrumentationKey": {
+              "type": "string",
+              "metadata": {
+                "description": "Application Insights Instrumentation key. A read-only value that applications can use to identify the destination for all telemetry sent to Azure Application Insights. This value will be supplied upon construction of each new Application Insights component."
+              },
+              "value": "[reference('appInsights').InstrumentationKey]"
+            },
+            "connectionString": {
+              "type": "string",
+              "metadata": {
+                "description": "Application Insights Connection String."
+              },
+              "value": "[reference('appInsights').ConnectionString]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "logAnalyticsWorkspace"
+      ]
+    },
+    "userAssignedIdentity": {
+      "condition": "[variables('userAssignedManagedIdentityEnabled')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('avm.res.managed-identity.user-assigned-identity.{0}', variables('userAssignedManagedIdentityResourceName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[variables('userAssignedManagedIdentityResourceName')]"
+          },
+          "tags": {
+            "value": "[coalesce(tryGet(parameters('userAssignedManagedIdentityConfiguration'), 'tags'), parameters('tags'))]"
+          },
+          "location": {
+            "value": "[coalesce(tryGet(parameters('userAssignedManagedIdentityConfiguration'), 'location'), parameters('solutionLocation'))]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.34.44.8038",
+              "templateHash": "16707109626832623586"
+            },
+            "name": "User Assigned Identities",
+            "description": "This module deploys a User Assigned Identity."
+          },
+          "definitions": {
+            "federatedIdentityCredentialType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the federated identity credential."
+                  }
+                },
+                "audiences": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "metadata": {
+                    "description": "Required. The list of audiences that can appear in the issued token."
+                  }
+                },
+                "issuer": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The URL of the issuer to be trusted."
+                  }
+                },
+                "subject": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The identifier of the external identity."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for the federated identity credential."
+              }
+            },
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a lock.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "roleAssignmentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                  }
+                },
+                "roleDefinitionIdOrName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                  }
+                },
+                "principalId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                  }
+                },
+                "principalType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Device",
+                    "ForeignGroup",
+                    "Group",
+                    "ServicePrincipal",
+                    "User"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The principal type of the assigned principal ID."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The description of the role assignment."
+                  }
+                },
+                "condition": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                  }
+                },
+                "conditionVersion": {
+                  "type": "string",
+                  "allowedValues": [
+                    "2.0"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Version of the condition."
+                  }
+                },
+                "delegatedManagedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a role assignment.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name of the User Assigned Identity."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all resources."
+              }
+            },
+            "federatedIdentityCredentials": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/federatedIdentityCredentialType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The federated identity credentials list to indicate which token from the external IdP should be trusted by your application. Federated identity credentials are supported on applications only. A maximum of 20 federated identity credentials can be added per application object."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "roleAssignments": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/roleAssignmentType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "formattedRoleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+              }
+            ],
+            "builtInRoleNames": {
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Managed Identity Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e40ec5ca-96e0-45a2-b4ff-59039f2c2b59')]",
+              "Managed Identity Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f1a07417-d97a-45cb-824c-7a7467783830')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+            }
+          },
+          "resources": {
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.managedidentity-userassignedidentity.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "userAssignedIdentity": {
+              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+              "apiVersion": "2024-11-30",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]"
+            },
+            "userAssignedIdentity_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.ManagedIdentity/userAssignedIdentities/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "userAssignedIdentity"
+              ]
+            },
+            "userAssignedIdentity_roleAssignments": {
+              "copy": {
+                "name": "userAssignedIdentity_roleAssignments",
+                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.ManagedIdentity/userAssignedIdentities/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+              "properties": {
+                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "userAssignedIdentity"
+              ]
+            },
+            "userAssignedIdentity_federatedIdentityCredentials": {
+              "copy": {
+                "name": "userAssignedIdentity_federatedIdentityCredentials",
+                "count": "[length(coalesce(parameters('federatedIdentityCredentials'), createArray()))]",
+                "mode": "serial",
+                "batchSize": 1
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-UserMSI-FederatedIdentityCred-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].name]"
+                  },
+                  "userAssignedIdentityName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "audiences": {
+                    "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].audiences]"
+                  },
+                  "issuer": {
+                    "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].issuer]"
+                  },
+                  "subject": {
+                    "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].subject]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "13656021764446440473"
+                    },
+                    "name": "User Assigned Identity Federated Identity Credential",
+                    "description": "This module deploys a User Assigned Identity Federated Identity Credential."
+                  },
+                  "parameters": {
+                    "userAssignedIdentityName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent user assigned identity. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the secret."
+                      }
+                    },
+                    "audiences": {
+                      "type": "array",
+                      "metadata": {
+                        "description": "Required. The list of audiences that can appear in the issued token. Should be set to api://AzureADTokenExchange for Azure AD. It says what Microsoft identity platform should accept in the aud claim in the incoming token. This value represents Azure AD in your external identity provider and has no fixed value across identity providers - you might need to create a new application registration in your IdP to serve as the audience of this token."
+                      }
+                    },
+                    "issuer": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The URL of the issuer to be trusted. Must match the issuer claim of the external token being exchanged."
+                      }
+                    },
+                    "subject": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The identifier of the external software workload within the external identity provider. Like the audience value, it has no fixed format, as each IdP uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. The value here must match the sub claim within the token presented to Azure AD."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials",
+                      "apiVersion": "2024-11-30",
+                      "name": "[format('{0}/{1}', parameters('userAssignedIdentityName'), parameters('name'))]",
+                      "properties": {
+                        "audiences": "[parameters('audiences')]",
+                        "issuer": "[parameters('issuer')]",
+                        "subject": "[parameters('subject')]"
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the federated identity credential."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the federated identity credential."
+                      },
+                      "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials', parameters('userAssignedIdentityName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the federated identity credential was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "userAssignedIdentity"
+              ]
+            }
+          },
+          "outputs": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the user assigned identity."
+              },
+              "value": "[parameters('name')]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the user assigned identity."
+              },
+              "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name'))]"
+            },
+            "principalId": {
+              "type": "string",
+              "metadata": {
+                "description": "The principal ID (object ID) of the user assigned identity."
+              },
+              "value": "[reference('userAssignedIdentity').principalId]"
+            },
+            "clientId": {
+              "type": "string",
+              "metadata": {
+                "description": "The client ID (application ID) of the user assigned identity."
+              },
+              "value": "[reference('userAssignedIdentity').clientId]"
+            },
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group the user assigned identity was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('userAssignedIdentity', '2024-11-30', 'full').location]"
+            }
+          }
+        }
+      }
+    },
+    "networkSecurityGroupBackend": {
+      "condition": "[and(variables('virtualNetworkEnabled'), variables('networkSecurityGroupBackendEnabled'))]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('avm.res.network.network-security-group.{0}', variables('networkSecurityGroupBackendResourceName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[variables('networkSecurityGroupBackendResourceName')]"
+          },
+          "location": {
+            "value": "[coalesce(tryGet(parameters('networkSecurityGroupBackendConfiguration'), 'location'), parameters('solutionLocation'))]"
+          },
+          "tags": {
+            "value": "[coalesce(tryGet(parameters('networkSecurityGroupBackendConfiguration'), 'tags'), parameters('tags'))]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "diagnosticSettings": {
+            "value": [
+              {
+                "workspaceResourceId": "[if(variables('useExistingWorkspace'), variables('existingWorkspaceResourceId'), listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId)]"
+              }
+            ]
+          },
+          "securityRules": {
+            "value": "[coalesce(tryGet(parameters('networkSecurityGroupBackendConfiguration'), 'securityRules'), createArray())]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.33.93.31351",
+              "templateHash": "2305747478751645177"
+            },
+            "name": "Network Security Groups",
+            "description": "This module deploys a Network security Group (NSG)."
+          },
+          "definitions": {
+            "securityRuleType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the security rule."
+                  }
+                },
+                "properties": {
+                  "type": "object",
+                  "properties": {
+                    "access": {
+                      "type": "string",
+                      "allowedValues": [
+                        "Allow",
+                        "Deny"
+                      ],
+                      "metadata": {
+                        "description": "Required. Whether network traffic is allowed or denied."
+                      }
+                    },
+                    "description": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The description of the security rule."
+                      }
+                    },
+                    "destinationAddressPrefix": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Optional. The destination address prefix. CIDR or destination IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used."
+                      }
+                    },
+                    "destinationAddressPrefixes": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The destination address prefixes. CIDR or destination IP ranges."
+                      }
+                    },
+                    "destinationApplicationSecurityGroupResourceIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resource IDs of the application security groups specified as destination."
+                      }
+                    },
+                    "destinationPortRange": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The destination port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                      }
+                    },
+                    "destinationPortRanges": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The destination port ranges."
+                      }
+                    },
+                    "direction": {
+                      "type": "string",
+                      "allowedValues": [
+                        "Inbound",
+                        "Outbound"
+                      ],
+                      "metadata": {
+                        "description": "Required. The direction of the rule. The direction specifies if rule will be evaluated on incoming or outgoing traffic."
+                      }
+                    },
+                    "priority": {
+                      "type": "int",
+                      "minValue": 100,
+                      "maxValue": 4096,
+                      "metadata": {
+                        "description": "Required. Required. The priority of the rule. The value can be between 100 and 4096. The priority number must be unique for each rule in the collection. The lower the priority number, the higher the priority of the rule."
+                      }
+                    },
+                    "protocol": {
+                      "type": "string",
+                      "allowedValues": [
+                        "*",
+                        "Ah",
+                        "Esp",
+                        "Icmp",
+                        "Tcp",
+                        "Udp"
+                      ],
+                      "metadata": {
+                        "description": "Required. Network protocol this rule applies to."
+                      }
+                    },
+                    "sourceAddressPrefix": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The CIDR or source IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used. If this is an ingress rule, specifies where network traffic originates from."
+                      }
+                    },
+                    "sourceAddressPrefixes": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The CIDR or source IP ranges."
+                      }
+                    },
+                    "sourceApplicationSecurityGroupResourceIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resource IDs of the application security groups specified as source."
+                      }
+                    },
+                    "sourcePortRange": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The source port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                      }
+                    },
+                    "sourcePortRanges": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The source port ranges."
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. The properties of the security rule."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type of a security rule."
+              }
+            },
+            "diagnosticSettingLogsOnlyType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of diagnostic setting."
+                  }
+                },
+                "logCategoriesAndGroups": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "category": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                        }
+                      },
+                      "categoryGroup": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                        }
+                      },
+                      "enabled": {
+                        "type": "bool",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                  }
+                },
+                "logAnalyticsDestinationType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "AzureDiagnostics",
+                    "Dedicated"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                  }
+                },
+                "workspaceResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "storageAccountResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "eventHubAuthorizationRuleResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                  }
+                },
+                "eventHubName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "marketplacePartnerResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a diagnostic setting. To be used if only logs are supported by the resource provider.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a lock.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "roleAssignmentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                  }
+                },
+                "roleDefinitionIdOrName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                  }
+                },
+                "principalId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                  }
+                },
+                "principalType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Device",
+                    "ForeignGroup",
+                    "Group",
+                    "ServicePrincipal",
+                    "User"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The principal type of the assigned principal ID."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The description of the role assignment."
+                  }
+                },
+                "condition": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                  }
+                },
+                "conditionVersion": {
+                  "type": "string",
+                  "allowedValues": [
+                    "2.0"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Version of the condition."
+                  }
+                },
+                "delegatedManagedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a role assignment.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name of the Network Security Group."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all resources."
+              }
+            },
+            "securityRules": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/securityRuleType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of Security Rules to deploy to the Network Security Group. When not provided, an NSG including only the built-in roles will be deployed."
+              }
+            },
+            "flushConnection": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. When enabled, flows created from Network Security Group connections will be re-evaluated when rules are updates. Initial enablement will trigger re-evaluation. Network Security Group connection flushing is not available in all regions."
+              }
+            },
+            "diagnosticSettings": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/diagnosticSettingLogsOnlyType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The diagnostic settings of the service."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "roleAssignments": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/roleAssignmentType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the NSG resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "formattedRoleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+              }
+            ],
+            "builtInRoleNames": {
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+            }
+          },
+          "resources": {
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.network-networksecuritygroup.{0}.{1}', replace('0.5.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "networkSecurityGroup": {
+              "type": "Microsoft.Network/networkSecurityGroups",
+              "apiVersion": "2023-11-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "securityRules",
+                    "count": "[length(coalesce(parameters('securityRules'), createArray()))]",
+                    "input": {
+                      "name": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].name]",
+                      "properties": {
+                        "access": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.access]",
+                        "description": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'description'), '')]",
+                        "destinationAddressPrefix": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationAddressPrefix'), '')]",
+                        "destinationAddressPrefixes": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationAddressPrefixes'), createArray())]",
+                        "destinationApplicationSecurityGroups": "[map(coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationApplicationSecurityGroupResourceIds'), createArray()), lambda('destinationApplicationSecurityGroupResourceId', createObject('id', lambdaVariables('destinationApplicationSecurityGroupResourceId'))))]",
+                        "destinationPortRange": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationPortRange'), '')]",
+                        "destinationPortRanges": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationPortRanges'), createArray())]",
+                        "direction": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.direction]",
+                        "priority": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.priority]",
+                        "protocol": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.protocol]",
+                        "sourceAddressPrefix": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceAddressPrefix'), '')]",
+                        "sourceAddressPrefixes": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceAddressPrefixes'), createArray())]",
+                        "sourceApplicationSecurityGroups": "[map(coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceApplicationSecurityGroupResourceIds'), createArray()), lambda('sourceApplicationSecurityGroupResourceId', createObject('id', lambdaVariables('sourceApplicationSecurityGroupResourceId'))))]",
+                        "sourcePortRange": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourcePortRange'), '')]",
+                        "sourcePortRanges": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourcePortRanges'), createArray())]"
+                      }
+                    }
+                  }
+                ],
+                "flushConnection": "[parameters('flushConnection')]"
+              }
+            },
+            "networkSecurityGroup_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "networkSecurityGroup"
+              ]
+            },
+            "networkSecurityGroup_diagnosticSettings": {
+              "copy": {
+                "name": "networkSecurityGroup_diagnosticSettings",
+                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+              },
+              "type": "Microsoft.Insights/diagnosticSettings",
+              "apiVersion": "2021-05-01-preview",
+              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "logs",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                    "input": {
+                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                    }
+                  }
+                ],
+                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+              },
+              "dependsOn": [
+                "networkSecurityGroup"
+              ]
+            },
+            "networkSecurityGroup_roleAssignments": {
+              "copy": {
+                "name": "networkSecurityGroup_roleAssignments",
+                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/networkSecurityGroups', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+              "properties": {
+                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "networkSecurityGroup"
+              ]
+            }
+          },
+          "outputs": {
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group the network security group was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the network security group."
+              },
+              "value": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the network security group."
+              },
+              "value": "[parameters('name')]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('networkSecurityGroup', '2023-11-01', 'full').location]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "logAnalyticsWorkspace"
+      ]
+    },
+    "networkSecurityGroupContainers": {
+      "condition": "[and(variables('virtualNetworkEnabled'), variables('networkSecurityGroupContainersEnabled'))]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('avm.res.network.network-security-group.{0}', variables('networkSecurityGroupContainersResourceName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[variables('networkSecurityGroupContainersResourceName')]"
+          },
+          "location": {
+            "value": "[coalesce(tryGet(parameters('networkSecurityGroupContainersConfiguration'), 'location'), parameters('solutionLocation'))]"
+          },
+          "tags": {
+            "value": "[coalesce(tryGet(parameters('networkSecurityGroupContainersConfiguration'), 'tags'), parameters('tags'))]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "diagnosticSettings": {
+            "value": [
+              {
+                "workspaceResourceId": "[if(variables('useExistingWorkspace'), variables('existingWorkspaceResourceId'), listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId)]"
+              }
+            ]
+          },
+          "securityRules": {
+            "value": "[coalesce(tryGet(parameters('networkSecurityGroupContainersConfiguration'), 'securityRules'), createArray())]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.33.93.31351",
+              "templateHash": "2305747478751645177"
+            },
+            "name": "Network Security Groups",
+            "description": "This module deploys a Network security Group (NSG)."
+          },
+          "definitions": {
+            "securityRuleType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the security rule."
+                  }
+                },
+                "properties": {
+                  "type": "object",
+                  "properties": {
+                    "access": {
+                      "type": "string",
+                      "allowedValues": [
+                        "Allow",
+                        "Deny"
+                      ],
+                      "metadata": {
+                        "description": "Required. Whether network traffic is allowed or denied."
+                      }
+                    },
+                    "description": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The description of the security rule."
+                      }
+                    },
+                    "destinationAddressPrefix": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Optional. The destination address prefix. CIDR or destination IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used."
+                      }
+                    },
+                    "destinationAddressPrefixes": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The destination address prefixes. CIDR or destination IP ranges."
+                      }
+                    },
+                    "destinationApplicationSecurityGroupResourceIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resource IDs of the application security groups specified as destination."
+                      }
+                    },
+                    "destinationPortRange": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The destination port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                      }
+                    },
+                    "destinationPortRanges": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The destination port ranges."
+                      }
+                    },
+                    "direction": {
+                      "type": "string",
+                      "allowedValues": [
+                        "Inbound",
+                        "Outbound"
+                      ],
+                      "metadata": {
+                        "description": "Required. The direction of the rule. The direction specifies if rule will be evaluated on incoming or outgoing traffic."
+                      }
+                    },
+                    "priority": {
+                      "type": "int",
+                      "minValue": 100,
+                      "maxValue": 4096,
+                      "metadata": {
+                        "description": "Required. Required. The priority of the rule. The value can be between 100 and 4096. The priority number must be unique for each rule in the collection. The lower the priority number, the higher the priority of the rule."
+                      }
+                    },
+                    "protocol": {
+                      "type": "string",
+                      "allowedValues": [
+                        "*",
+                        "Ah",
+                        "Esp",
+                        "Icmp",
+                        "Tcp",
+                        "Udp"
+                      ],
+                      "metadata": {
+                        "description": "Required. Network protocol this rule applies to."
+                      }
+                    },
+                    "sourceAddressPrefix": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The CIDR or source IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used. If this is an ingress rule, specifies where network traffic originates from."
+                      }
+                    },
+                    "sourceAddressPrefixes": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The CIDR or source IP ranges."
+                      }
+                    },
+                    "sourceApplicationSecurityGroupResourceIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resource IDs of the application security groups specified as source."
+                      }
+                    },
+                    "sourcePortRange": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The source port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                      }
+                    },
+                    "sourcePortRanges": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The source port ranges."
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. The properties of the security rule."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type of a security rule."
+              }
+            },
+            "diagnosticSettingLogsOnlyType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of diagnostic setting."
+                  }
+                },
+                "logCategoriesAndGroups": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "category": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                        }
+                      },
+                      "categoryGroup": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                        }
+                      },
+                      "enabled": {
+                        "type": "bool",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                  }
+                },
+                "logAnalyticsDestinationType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "AzureDiagnostics",
+                    "Dedicated"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                  }
+                },
+                "workspaceResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "storageAccountResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "eventHubAuthorizationRuleResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                  }
+                },
+                "eventHubName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "marketplacePartnerResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a diagnostic setting. To be used if only logs are supported by the resource provider.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a lock.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "roleAssignmentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                  }
+                },
+                "roleDefinitionIdOrName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                  }
+                },
+                "principalId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                  }
+                },
+                "principalType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Device",
+                    "ForeignGroup",
+                    "Group",
+                    "ServicePrincipal",
+                    "User"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The principal type of the assigned principal ID."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The description of the role assignment."
+                  }
+                },
+                "condition": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                  }
+                },
+                "conditionVersion": {
+                  "type": "string",
+                  "allowedValues": [
+                    "2.0"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Version of the condition."
+                  }
+                },
+                "delegatedManagedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a role assignment.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name of the Network Security Group."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all resources."
+              }
+            },
+            "securityRules": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/securityRuleType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of Security Rules to deploy to the Network Security Group. When not provided, an NSG including only the built-in roles will be deployed."
+              }
+            },
+            "flushConnection": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. When enabled, flows created from Network Security Group connections will be re-evaluated when rules are updates. Initial enablement will trigger re-evaluation. Network Security Group connection flushing is not available in all regions."
+              }
+            },
+            "diagnosticSettings": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/diagnosticSettingLogsOnlyType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The diagnostic settings of the service."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "roleAssignments": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/roleAssignmentType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the NSG resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "formattedRoleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+              }
+            ],
+            "builtInRoleNames": {
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+            }
+          },
+          "resources": {
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.network-networksecuritygroup.{0}.{1}', replace('0.5.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "networkSecurityGroup": {
+              "type": "Microsoft.Network/networkSecurityGroups",
+              "apiVersion": "2023-11-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "securityRules",
+                    "count": "[length(coalesce(parameters('securityRules'), createArray()))]",
+                    "input": {
+                      "name": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].name]",
+                      "properties": {
+                        "access": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.access]",
+                        "description": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'description'), '')]",
+                        "destinationAddressPrefix": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationAddressPrefix'), '')]",
+                        "destinationAddressPrefixes": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationAddressPrefixes'), createArray())]",
+                        "destinationApplicationSecurityGroups": "[map(coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationApplicationSecurityGroupResourceIds'), createArray()), lambda('destinationApplicationSecurityGroupResourceId', createObject('id', lambdaVariables('destinationApplicationSecurityGroupResourceId'))))]",
+                        "destinationPortRange": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationPortRange'), '')]",
+                        "destinationPortRanges": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationPortRanges'), createArray())]",
+                        "direction": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.direction]",
+                        "priority": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.priority]",
+                        "protocol": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.protocol]",
+                        "sourceAddressPrefix": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceAddressPrefix'), '')]",
+                        "sourceAddressPrefixes": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceAddressPrefixes'), createArray())]",
+                        "sourceApplicationSecurityGroups": "[map(coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceApplicationSecurityGroupResourceIds'), createArray()), lambda('sourceApplicationSecurityGroupResourceId', createObject('id', lambdaVariables('sourceApplicationSecurityGroupResourceId'))))]",
+                        "sourcePortRange": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourcePortRange'), '')]",
+                        "sourcePortRanges": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourcePortRanges'), createArray())]"
+                      }
+                    }
+                  }
+                ],
+                "flushConnection": "[parameters('flushConnection')]"
+              }
+            },
+            "networkSecurityGroup_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "networkSecurityGroup"
+              ]
+            },
+            "networkSecurityGroup_diagnosticSettings": {
+              "copy": {
+                "name": "networkSecurityGroup_diagnosticSettings",
+                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+              },
+              "type": "Microsoft.Insights/diagnosticSettings",
+              "apiVersion": "2021-05-01-preview",
+              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "logs",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                    "input": {
+                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                    }
+                  }
+                ],
+                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+              },
+              "dependsOn": [
+                "networkSecurityGroup"
+              ]
+            },
+            "networkSecurityGroup_roleAssignments": {
+              "copy": {
+                "name": "networkSecurityGroup_roleAssignments",
+                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/networkSecurityGroups', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+              "properties": {
+                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "networkSecurityGroup"
+              ]
+            }
+          },
+          "outputs": {
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group the network security group was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the network security group."
+              },
+              "value": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the network security group."
+              },
+              "value": "[parameters('name')]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('networkSecurityGroup', '2023-11-01', 'full').location]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "logAnalyticsWorkspace"
+      ]
+    },
+    "networkSecurityGroupBastion": {
+      "condition": "[and(variables('virtualNetworkEnabled'), variables('networkSecurityGroupBastionEnabled'))]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('avm.res.network.network-security-group.{0}', variables('networkSecurityGroupBastionResourceName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[variables('networkSecurityGroupBastionResourceName')]"
+          },
+          "location": {
+            "value": "[coalesce(tryGet(parameters('networkSecurityGroupBastionConfiguration'), 'location'), parameters('solutionLocation'))]"
+          },
+          "tags": {
+            "value": "[coalesce(tryGet(parameters('networkSecurityGroupBastionConfiguration'), 'tags'), parameters('tags'))]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "diagnosticSettings": {
+            "value": [
+              {
+                "workspaceResourceId": "[if(variables('useExistingWorkspace'), variables('existingWorkspaceResourceId'), listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId)]"
+              }
+            ]
+          },
+          "securityRules": {
+            "value": "[coalesce(tryGet(parameters('networkSecurityGroupBastionConfiguration'), 'securityRules'), createArray(createObject('name', 'AllowHttpsInBound', 'properties', createObject('protocol', 'Tcp', 'sourcePortRange', '*', 'sourceAddressPrefix', 'Internet', 'destinationPortRange', '443', 'destinationAddressPrefix', '*', 'access', 'Allow', 'priority', 100, 'direction', 'Inbound')), createObject('name', 'AllowGatewayManagerInBound', 'properties', createObject('protocol', 'Tcp', 'sourcePortRange', '*', 'sourceAddressPrefix', 'GatewayManager', 'destinationPortRange', '443', 'destinationAddressPrefix', '*', 'access', 'Allow', 'priority', 110, 'direction', 'Inbound')), createObject('name', 'AllowLoadBalancerInBound', 'properties', createObject('protocol', 'Tcp', 'sourcePortRange', '*', 'sourceAddressPrefix', 'AzureLoadBalancer', 'destinationPortRange', '443', 'destinationAddressPrefix', '*', 'access', 'Allow', 'priority', 120, 'direction', 'Inbound')), createObject('name', 'AllowBastionHostCommunicationInBound', 'properties', createObject('protocol', '*', 'sourcePortRange', '*', 'sourceAddressPrefix', 'VirtualNetwork', 'destinationPortRanges', createArray('8080', '5701'), 'destinationAddressPrefix', 'VirtualNetwork', 'access', 'Allow', 'priority', 130, 'direction', 'Inbound')), createObject('name', 'DenyAllInBound', 'properties', createObject('protocol', '*', 'sourcePortRange', '*', 'sourceAddressPrefix', '*', 'destinationPortRange', '*', 'destinationAddressPrefix', '*', 'access', 'Deny', 'priority', 1000, 'direction', 'Inbound')), createObject('name', 'AllowSshRdpOutBound', 'properties', createObject('protocol', 'Tcp', 'sourcePortRange', '*', 'sourceAddressPrefix', '*', 'destinationPortRanges', createArray('22', '3389'), 'destinationAddressPrefix', 'VirtualNetwork', 'access', 'Allow', 'priority', 100, 'direction', 'Outbound')), createObject('name', 'AllowAzureCloudCommunicationOutBound', 'properties', createObject('protocol', 'Tcp', 'sourcePortRange', '*', 'sourceAddressPrefix', '*', 'destinationPortRange', '443', 'destinationAddressPrefix', 'AzureCloud', 'access', 'Allow', 'priority', 110, 'direction', 'Outbound')), createObject('name', 'AllowBastionHostCommunicationOutBound', 'properties', createObject('protocol', '*', 'sourcePortRange', '*', 'sourceAddressPrefix', 'VirtualNetwork', 'destinationPortRanges', createArray('8080', '5701'), 'destinationAddressPrefix', 'VirtualNetwork', 'access', 'Allow', 'priority', 120, 'direction', 'Outbound')), createObject('name', 'AllowGetSessionInformationOutBound', 'properties', createObject('protocol', '*', 'sourcePortRange', '*', 'sourceAddressPrefix', '*', 'destinationAddressPrefix', 'Internet', 'destinationPortRanges', createArray('80', '443'), 'access', 'Allow', 'priority', 130, 'direction', 'Outbound')), createObject('name', 'DenyAllOutBound', 'properties', createObject('protocol', '*', 'sourcePortRange', '*', 'destinationPortRange', '*', 'sourceAddressPrefix', '*', 'destinationAddressPrefix', '*', 'access', 'Deny', 'priority', 1000, 'direction', 'Outbound'))))]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.33.93.31351",
+              "templateHash": "2305747478751645177"
+            },
+            "name": "Network Security Groups",
+            "description": "This module deploys a Network security Group (NSG)."
+          },
+          "definitions": {
+            "securityRuleType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the security rule."
+                  }
+                },
+                "properties": {
+                  "type": "object",
+                  "properties": {
+                    "access": {
+                      "type": "string",
+                      "allowedValues": [
+                        "Allow",
+                        "Deny"
+                      ],
+                      "metadata": {
+                        "description": "Required. Whether network traffic is allowed or denied."
+                      }
+                    },
+                    "description": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The description of the security rule."
+                      }
+                    },
+                    "destinationAddressPrefix": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Optional. The destination address prefix. CIDR or destination IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used."
+                      }
+                    },
+                    "destinationAddressPrefixes": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The destination address prefixes. CIDR or destination IP ranges."
+                      }
+                    },
+                    "destinationApplicationSecurityGroupResourceIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resource IDs of the application security groups specified as destination."
+                      }
+                    },
+                    "destinationPortRange": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The destination port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                      }
+                    },
+                    "destinationPortRanges": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The destination port ranges."
+                      }
+                    },
+                    "direction": {
+                      "type": "string",
+                      "allowedValues": [
+                        "Inbound",
+                        "Outbound"
+                      ],
+                      "metadata": {
+                        "description": "Required. The direction of the rule. The direction specifies if rule will be evaluated on incoming or outgoing traffic."
+                      }
+                    },
+                    "priority": {
+                      "type": "int",
+                      "minValue": 100,
+                      "maxValue": 4096,
+                      "metadata": {
+                        "description": "Required. Required. The priority of the rule. The value can be between 100 and 4096. The priority number must be unique for each rule in the collection. The lower the priority number, the higher the priority of the rule."
+                      }
+                    },
+                    "protocol": {
+                      "type": "string",
+                      "allowedValues": [
+                        "*",
+                        "Ah",
+                        "Esp",
+                        "Icmp",
+                        "Tcp",
+                        "Udp"
+                      ],
+                      "metadata": {
+                        "description": "Required. Network protocol this rule applies to."
+                      }
+                    },
+                    "sourceAddressPrefix": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The CIDR or source IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used. If this is an ingress rule, specifies where network traffic originates from."
+                      }
+                    },
+                    "sourceAddressPrefixes": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The CIDR or source IP ranges."
+                      }
+                    },
+                    "sourceApplicationSecurityGroupResourceIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resource IDs of the application security groups specified as source."
+                      }
+                    },
+                    "sourcePortRange": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The source port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                      }
+                    },
+                    "sourcePortRanges": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The source port ranges."
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. The properties of the security rule."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type of a security rule."
+              }
+            },
+            "diagnosticSettingLogsOnlyType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of diagnostic setting."
+                  }
+                },
+                "logCategoriesAndGroups": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "category": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                        }
+                      },
+                      "categoryGroup": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                        }
+                      },
+                      "enabled": {
+                        "type": "bool",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                  }
+                },
+                "logAnalyticsDestinationType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "AzureDiagnostics",
+                    "Dedicated"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                  }
+                },
+                "workspaceResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "storageAccountResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "eventHubAuthorizationRuleResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                  }
+                },
+                "eventHubName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "marketplacePartnerResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a diagnostic setting. To be used if only logs are supported by the resource provider.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a lock.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "roleAssignmentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                  }
+                },
+                "roleDefinitionIdOrName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                  }
+                },
+                "principalId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                  }
+                },
+                "principalType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Device",
+                    "ForeignGroup",
+                    "Group",
+                    "ServicePrincipal",
+                    "User"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The principal type of the assigned principal ID."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The description of the role assignment."
+                  }
+                },
+                "condition": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                  }
+                },
+                "conditionVersion": {
+                  "type": "string",
+                  "allowedValues": [
+                    "2.0"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Version of the condition."
+                  }
+                },
+                "delegatedManagedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a role assignment.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name of the Network Security Group."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all resources."
+              }
+            },
+            "securityRules": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/securityRuleType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of Security Rules to deploy to the Network Security Group. When not provided, an NSG including only the built-in roles will be deployed."
+              }
+            },
+            "flushConnection": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. When enabled, flows created from Network Security Group connections will be re-evaluated when rules are updates. Initial enablement will trigger re-evaluation. Network Security Group connection flushing is not available in all regions."
+              }
+            },
+            "diagnosticSettings": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/diagnosticSettingLogsOnlyType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The diagnostic settings of the service."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "roleAssignments": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/roleAssignmentType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the NSG resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "formattedRoleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+              }
+            ],
+            "builtInRoleNames": {
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+            }
+          },
+          "resources": {
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.network-networksecuritygroup.{0}.{1}', replace('0.5.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "networkSecurityGroup": {
+              "type": "Microsoft.Network/networkSecurityGroups",
+              "apiVersion": "2023-11-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "securityRules",
+                    "count": "[length(coalesce(parameters('securityRules'), createArray()))]",
+                    "input": {
+                      "name": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].name]",
+                      "properties": {
+                        "access": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.access]",
+                        "description": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'description'), '')]",
+                        "destinationAddressPrefix": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationAddressPrefix'), '')]",
+                        "destinationAddressPrefixes": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationAddressPrefixes'), createArray())]",
+                        "destinationApplicationSecurityGroups": "[map(coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationApplicationSecurityGroupResourceIds'), createArray()), lambda('destinationApplicationSecurityGroupResourceId', createObject('id', lambdaVariables('destinationApplicationSecurityGroupResourceId'))))]",
+                        "destinationPortRange": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationPortRange'), '')]",
+                        "destinationPortRanges": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationPortRanges'), createArray())]",
+                        "direction": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.direction]",
+                        "priority": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.priority]",
+                        "protocol": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.protocol]",
+                        "sourceAddressPrefix": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceAddressPrefix'), '')]",
+                        "sourceAddressPrefixes": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceAddressPrefixes'), createArray())]",
+                        "sourceApplicationSecurityGroups": "[map(coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceApplicationSecurityGroupResourceIds'), createArray()), lambda('sourceApplicationSecurityGroupResourceId', createObject('id', lambdaVariables('sourceApplicationSecurityGroupResourceId'))))]",
+                        "sourcePortRange": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourcePortRange'), '')]",
+                        "sourcePortRanges": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourcePortRanges'), createArray())]"
+                      }
+                    }
+                  }
+                ],
+                "flushConnection": "[parameters('flushConnection')]"
+              }
+            },
+            "networkSecurityGroup_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "networkSecurityGroup"
+              ]
+            },
+            "networkSecurityGroup_diagnosticSettings": {
+              "copy": {
+                "name": "networkSecurityGroup_diagnosticSettings",
+                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+              },
+              "type": "Microsoft.Insights/diagnosticSettings",
+              "apiVersion": "2021-05-01-preview",
+              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "logs",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                    "input": {
+                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                    }
+                  }
+                ],
+                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+              },
+              "dependsOn": [
+                "networkSecurityGroup"
+              ]
+            },
+            "networkSecurityGroup_roleAssignments": {
+              "copy": {
+                "name": "networkSecurityGroup_roleAssignments",
+                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/networkSecurityGroups', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+              "properties": {
+                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "networkSecurityGroup"
+              ]
+            }
+          },
+          "outputs": {
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group the network security group was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the network security group."
+              },
+              "value": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the network security group."
+              },
+              "value": "[parameters('name')]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('networkSecurityGroup', '2023-11-01', 'full').location]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "logAnalyticsWorkspace"
+      ]
+    },
+    "networkSecurityGroupAdministration": {
+      "condition": "[and(variables('virtualNetworkEnabled'), variables('networkSecurityGroupAdministrationEnabled'))]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('avm.res.network.network-security-group.{0}', variables('networkSecurityGroupAdministrationResourceName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[variables('networkSecurityGroupAdministrationResourceName')]"
+          },
+          "location": {
+            "value": "[coalesce(tryGet(parameters('networkSecurityGroupAdministrationConfiguration'), 'location'), parameters('solutionLocation'))]"
+          },
+          "tags": {
+            "value": "[coalesce(tryGet(parameters('networkSecurityGroupAdministrationConfiguration'), 'tags'), parameters('tags'))]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "diagnosticSettings": {
+            "value": [
+              {
+                "workspaceResourceId": "[if(variables('useExistingWorkspace'), variables('existingWorkspaceResourceId'), listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId)]"
+              }
+            ]
+          },
+          "securityRules": {
+            "value": "[coalesce(tryGet(parameters('networkSecurityGroupAdministrationConfiguration'), 'securityRules'), createArray())]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.33.93.31351",
+              "templateHash": "2305747478751645177"
+            },
+            "name": "Network Security Groups",
+            "description": "This module deploys a Network security Group (NSG)."
+          },
+          "definitions": {
+            "securityRuleType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the security rule."
+                  }
+                },
+                "properties": {
+                  "type": "object",
+                  "properties": {
+                    "access": {
+                      "type": "string",
+                      "allowedValues": [
+                        "Allow",
+                        "Deny"
+                      ],
+                      "metadata": {
+                        "description": "Required. Whether network traffic is allowed or denied."
+                      }
+                    },
+                    "description": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The description of the security rule."
+                      }
+                    },
+                    "destinationAddressPrefix": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Optional. The destination address prefix. CIDR or destination IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used."
+                      }
+                    },
+                    "destinationAddressPrefixes": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The destination address prefixes. CIDR or destination IP ranges."
+                      }
+                    },
+                    "destinationApplicationSecurityGroupResourceIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resource IDs of the application security groups specified as destination."
+                      }
+                    },
+                    "destinationPortRange": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The destination port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                      }
+                    },
+                    "destinationPortRanges": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The destination port ranges."
+                      }
+                    },
+                    "direction": {
+                      "type": "string",
+                      "allowedValues": [
+                        "Inbound",
+                        "Outbound"
+                      ],
+                      "metadata": {
+                        "description": "Required. The direction of the rule. The direction specifies if rule will be evaluated on incoming or outgoing traffic."
+                      }
+                    },
+                    "priority": {
+                      "type": "int",
+                      "minValue": 100,
+                      "maxValue": 4096,
+                      "metadata": {
+                        "description": "Required. Required. The priority of the rule. The value can be between 100 and 4096. The priority number must be unique for each rule in the collection. The lower the priority number, the higher the priority of the rule."
+                      }
+                    },
+                    "protocol": {
+                      "type": "string",
+                      "allowedValues": [
+                        "*",
+                        "Ah",
+                        "Esp",
+                        "Icmp",
+                        "Tcp",
+                        "Udp"
+                      ],
+                      "metadata": {
+                        "description": "Required. Network protocol this rule applies to."
+                      }
+                    },
+                    "sourceAddressPrefix": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The CIDR or source IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used. If this is an ingress rule, specifies where network traffic originates from."
+                      }
+                    },
+                    "sourceAddressPrefixes": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The CIDR or source IP ranges."
+                      }
+                    },
+                    "sourceApplicationSecurityGroupResourceIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resource IDs of the application security groups specified as source."
+                      }
+                    },
+                    "sourcePortRange": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The source port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                      }
+                    },
+                    "sourcePortRanges": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The source port ranges."
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. The properties of the security rule."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type of a security rule."
+              }
+            },
+            "diagnosticSettingLogsOnlyType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of diagnostic setting."
+                  }
+                },
+                "logCategoriesAndGroups": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "category": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                        }
+                      },
+                      "categoryGroup": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                        }
+                      },
+                      "enabled": {
+                        "type": "bool",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                  }
+                },
+                "logAnalyticsDestinationType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "AzureDiagnostics",
+                    "Dedicated"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                  }
+                },
+                "workspaceResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "storageAccountResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "eventHubAuthorizationRuleResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                  }
+                },
+                "eventHubName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "marketplacePartnerResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a diagnostic setting. To be used if only logs are supported by the resource provider.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a lock.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "roleAssignmentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                  }
+                },
+                "roleDefinitionIdOrName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                  }
+                },
+                "principalId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                  }
+                },
+                "principalType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Device",
+                    "ForeignGroup",
+                    "Group",
+                    "ServicePrincipal",
+                    "User"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The principal type of the assigned principal ID."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The description of the role assignment."
+                  }
+                },
+                "condition": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                  }
+                },
+                "conditionVersion": {
+                  "type": "string",
+                  "allowedValues": [
+                    "2.0"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Version of the condition."
+                  }
+                },
+                "delegatedManagedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a role assignment.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name of the Network Security Group."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all resources."
+              }
+            },
+            "securityRules": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/securityRuleType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of Security Rules to deploy to the Network Security Group. When not provided, an NSG including only the built-in roles will be deployed."
+              }
+            },
+            "flushConnection": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. When enabled, flows created from Network Security Group connections will be re-evaluated when rules are updates. Initial enablement will trigger re-evaluation. Network Security Group connection flushing is not available in all regions."
+              }
+            },
+            "diagnosticSettings": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/diagnosticSettingLogsOnlyType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The diagnostic settings of the service."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "roleAssignments": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/roleAssignmentType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the NSG resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "formattedRoleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+              }
+            ],
+            "builtInRoleNames": {
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+            }
+          },
+          "resources": {
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.network-networksecuritygroup.{0}.{1}', replace('0.5.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "networkSecurityGroup": {
+              "type": "Microsoft.Network/networkSecurityGroups",
+              "apiVersion": "2023-11-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "securityRules",
+                    "count": "[length(coalesce(parameters('securityRules'), createArray()))]",
+                    "input": {
+                      "name": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].name]",
+                      "properties": {
+                        "access": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.access]",
+                        "description": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'description'), '')]",
+                        "destinationAddressPrefix": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationAddressPrefix'), '')]",
+                        "destinationAddressPrefixes": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationAddressPrefixes'), createArray())]",
+                        "destinationApplicationSecurityGroups": "[map(coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationApplicationSecurityGroupResourceIds'), createArray()), lambda('destinationApplicationSecurityGroupResourceId', createObject('id', lambdaVariables('destinationApplicationSecurityGroupResourceId'))))]",
+                        "destinationPortRange": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationPortRange'), '')]",
+                        "destinationPortRanges": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationPortRanges'), createArray())]",
+                        "direction": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.direction]",
+                        "priority": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.priority]",
+                        "protocol": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.protocol]",
+                        "sourceAddressPrefix": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceAddressPrefix'), '')]",
+                        "sourceAddressPrefixes": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceAddressPrefixes'), createArray())]",
+                        "sourceApplicationSecurityGroups": "[map(coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceApplicationSecurityGroupResourceIds'), createArray()), lambda('sourceApplicationSecurityGroupResourceId', createObject('id', lambdaVariables('sourceApplicationSecurityGroupResourceId'))))]",
+                        "sourcePortRange": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourcePortRange'), '')]",
+                        "sourcePortRanges": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourcePortRanges'), createArray())]"
+                      }
+                    }
+                  }
+                ],
+                "flushConnection": "[parameters('flushConnection')]"
+              }
+            },
+            "networkSecurityGroup_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "networkSecurityGroup"
+              ]
+            },
+            "networkSecurityGroup_diagnosticSettings": {
+              "copy": {
+                "name": "networkSecurityGroup_diagnosticSettings",
+                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+              },
+              "type": "Microsoft.Insights/diagnosticSettings",
+              "apiVersion": "2021-05-01-preview",
+              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "logs",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                    "input": {
+                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                    }
+                  }
+                ],
+                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+              },
+              "dependsOn": [
+                "networkSecurityGroup"
+              ]
+            },
+            "networkSecurityGroup_roleAssignments": {
+              "copy": {
+                "name": "networkSecurityGroup_roleAssignments",
+                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/networkSecurityGroups', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+              "properties": {
+                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "networkSecurityGroup"
+              ]
+            }
+          },
+          "outputs": {
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group the network security group was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the network security group."
+              },
+              "value": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the network security group."
+              },
+              "value": "[parameters('name')]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('networkSecurityGroup', '2023-11-01', 'full').location]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "logAnalyticsWorkspace"
+      ]
+    },
+    "virtualNetwork": {
+      "condition": "[variables('virtualNetworkEnabled')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('avm.res.network.virtual-network.{0}', variables('virtualNetworkResourceName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[variables('virtualNetworkResourceName')]"
+          },
+          "location": {
+            "value": "[coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'location'), parameters('solutionLocation'))]"
+          },
+          "tags": {
+            "value": "[coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'tags'), parameters('tags'))]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "addressPrefixes": {
+            "value": "[coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'addressPrefixes'), createArray('10.0.0.0/8'))]"
+          },
+          "subnets": {
+            "value": "[coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'subnets'), createArray(createObject('name', 'backend', 'addressPrefix', '10.0.0.0/27', 'networkSecurityGroupResourceId', reference('networkSecurityGroupBackend').outputs.resourceId.value), createObject('name', 'administration', 'addressPrefix', '10.0.0.32/27', 'networkSecurityGroupResourceId', reference('networkSecurityGroupAdministration').outputs.resourceId.value), createObject('name', 'AzureBastionSubnet', 'addressPrefix', '10.0.0.64/26', 'networkSecurityGroupResourceId', reference('networkSecurityGroupBastion').outputs.resourceId.value), createObject('name', 'containers', 'addressPrefix', '10.0.2.0/23', 'delegation', 'Microsoft.App/environments', 'networkSecurityGroupResourceId', reference('networkSecurityGroupContainers').outputs.resourceId.value, 'privateEndpointNetworkPolicies', 'Disabled', 'privateLinkServiceNetworkPolicies', 'Enabled')))]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.34.1.11899",
+              "templateHash": "4090376738500728310"
+            },
+            "name": "Virtual Networks",
+            "description": "This module deploys a Virtual Network (vNet)."
+          },
+          "definitions": {
+            "peeringType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Name of VNET Peering resource. If not provided, default value will be peer-localVnetName-remoteVnetName."
+                  }
+                },
+                "remoteVirtualNetworkResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The Resource ID of the VNet that is this Local VNet is being peered to. Should be in the format of a Resource ID."
+                  }
+                },
+                "allowForwardedTraffic": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Whether the forwarded traffic from the VMs in the local virtual network will be allowed/disallowed in remote virtual network. Default is true."
+                  }
+                },
+                "allowGatewayTransit": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. If gateway links can be used in remote virtual networking to link to this virtual network. Default is false."
+                  }
+                },
+                "allowVirtualNetworkAccess": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Whether the VMs in the local virtual network space would be able to access the VMs in remote virtual network space. Default is true."
+                  }
+                },
+                "doNotVerifyRemoteGateways": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Do not verify the provisioning state of the remote gateway. Default is true."
+                  }
+                },
+                "useRemoteGateways": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. If remote gateways can be used on this virtual network. If the flag is set to true, and allowGatewayTransit on remote peering is also true, virtual network will use gateways of remote virtual network for transit. Only one peering can have this flag set to true. This flag cannot be set if virtual network already has a gateway. Default is false."
+                  }
+                },
+                "remotePeeringEnabled": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Deploy the outbound and the inbound peering."
+                  }
+                },
+                "remotePeeringName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the VNET Peering resource in the remove Virtual Network. If not provided, default value will be peer-remoteVnetName-localVnetName."
+                  }
+                },
+                "remotePeeringAllowForwardedTraffic": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Whether the forwarded traffic from the VMs in the local virtual network will be allowed/disallowed in remote virtual network. Default is true."
+                  }
+                },
+                "remotePeeringAllowGatewayTransit": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. If gateway links can be used in remote virtual networking to link to this virtual network. Default is false."
+                  }
+                },
+                "remotePeeringAllowVirtualNetworkAccess": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Whether the VMs in the local virtual network space would be able to access the VMs in remote virtual network space. Default is true."
+                  }
+                },
+                "remotePeeringDoNotVerifyRemoteGateways": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Do not verify the provisioning state of the remote gateway. Default is true."
+                  }
+                },
+                "remotePeeringUseRemoteGateways": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. If remote gateways can be used on this virtual network. If the flag is set to true, and allowGatewayTransit on remote peering is also true, virtual network will use gateways of remote virtual network for transit. Only one peering can have this flag set to true. This flag cannot be set if virtual network already has a gateway. Default is false."
+                  }
+                }
+              }
+            },
+            "subnetType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The Name of the subnet resource."
+                  }
+                },
+                "addressPrefix": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Conditional. The address prefix for the subnet. Required if `addressPrefixes` is empty."
+                  }
+                },
+                "addressPrefixes": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Conditional. List of address prefixes for the subnet. Required if `addressPrefix` is empty."
+                  }
+                },
+                "applicationGatewayIPConfigurations": {
+                  "type": "array",
+                  "items": {
+                    "type": "object"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Application gateway IP configurations of virtual network resource."
+                  }
+                },
+                "delegation": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The delegation to enable on the subnet."
+                  }
+                },
+                "natGatewayResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID of the NAT Gateway to use for the subnet."
+                  }
+                },
+                "networkSecurityGroupResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID of the network security group to assign to the subnet."
+                  }
+                },
+                "privateEndpointNetworkPolicies": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Disabled",
+                    "Enabled",
+                    "NetworkSecurityGroupEnabled",
+                    "RouteTableEnabled"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. enable or disable apply network policies on private endpoint in the subnet."
+                  }
+                },
+                "privateLinkServiceNetworkPolicies": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Disabled",
+                    "Enabled"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. enable or disable apply network policies on private link service in the subnet."
+                  }
+                },
+                "roleAssignments": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/roleAssignmentType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Array of role assignments to create."
+                  }
+                },
+                "routeTableResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID of the route table to assign to the subnet."
+                  }
+                },
+                "serviceEndpointPolicies": {
+                  "type": "array",
+                  "items": {
+                    "type": "object"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. An array of service endpoint policies."
+                  }
+                },
+                "serviceEndpoints": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The service endpoints to enable on the subnet."
+                  }
+                },
+                "defaultOutboundAccess": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Set this property to false to disable default outbound connectivity for all VMs in the subnet. This property can only be set at the time of subnet creation and cannot be updated for an existing subnet."
+                  }
+                },
+                "sharingScope": {
+                  "type": "string",
+                  "allowedValues": [
+                    "DelegatedServices",
+                    "Tenant"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Set this property to Tenant to allow sharing subnet with other subscriptions in your AAD tenant. This property can only be set if defaultOutboundAccess is set to false, both properties can only be set if subnet is empty."
+                  }
+                }
+              }
+            },
+            "diagnosticSettingFullType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the diagnostic setting."
+                  }
+                },
+                "logCategoriesAndGroups": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "category": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                        }
+                      },
+                      "categoryGroup": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                        }
+                      },
+                      "enabled": {
+                        "type": "bool",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                  }
+                },
+                "metricCategories": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "category": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                        }
+                      },
+                      "enabled": {
+                        "type": "bool",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                  }
+                },
+                "logAnalyticsDestinationType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "AzureDiagnostics",
+                    "Dedicated"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                  }
+                },
+                "workspaceResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "storageAccountResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "eventHubAuthorizationRuleResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                  }
+                },
+                "eventHubName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "marketplacePartnerResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
+                }
+              }
+            },
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a lock.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
+                }
+              }
+            },
+            "roleAssignmentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                  }
+                },
+                "roleDefinitionIdOrName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                  }
+                },
+                "principalId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                  }
+                },
+                "principalType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Device",
+                    "ForeignGroup",
+                    "Group",
+                    "ServicePrincipal",
+                    "User"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The principal type of the assigned principal ID."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The description of the role assignment."
+                  }
+                },
+                "condition": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                  }
+                },
+                "conditionVersion": {
+                  "type": "string",
+                  "allowedValues": [
+                    "2.0"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Version of the condition."
+                  }
+                },
+                "delegatedManagedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a role assignment.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
+                }
+              }
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. The name of the Virtual Network (vNet)."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all resources."
+              }
+            },
+            "addressPrefixes": {
+              "type": "array",
+              "metadata": {
+                "description": "Required. An Array of 1 or more IP Address Prefixes for the Virtual Network."
+              }
+            },
+            "virtualNetworkBgpCommunity": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The BGP community associated with the virtual network."
+              }
+            },
+            "subnets": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/subnetType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. An Array of subnets to deploy to the Virtual Network."
+              }
+            },
+            "dnsServers": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. DNS Servers associated to the Virtual Network."
+              }
+            },
+            "ddosProtectionPlanResourceId": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Resource ID of the DDoS protection plan to assign the VNET to. If it's left blank, DDoS protection will not be configured. If it's provided, the VNET created by this template will be attached to the referenced DDoS protection plan. The DDoS protection plan can exist in the same or in a different subscription."
+              }
+            },
+            "peerings": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/peeringType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Virtual Network Peering configurations."
+              }
+            },
+            "vnetEncryption": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Indicates if encryption is enabled on virtual network and if VM without encryption is allowed in encrypted VNet. Requires the EnableVNetEncryption feature to be registered for the subscription and a supported region to use this property."
+              }
+            },
+            "vnetEncryptionEnforcement": {
+              "type": "string",
+              "defaultValue": "AllowUnencrypted",
+              "allowedValues": [
+                "AllowUnencrypted",
+                "DropUnencrypted"
+              ],
+              "metadata": {
+                "description": "Optional. If the encrypted VNet allows VM that does not support encryption. Can only be used when vnetEncryption is enabled."
+              }
+            },
+            "flowTimeoutInMinutes": {
+              "type": "int",
+              "defaultValue": 0,
+              "maxValue": 30,
+              "metadata": {
+                "description": "Optional. The flow timeout in minutes for the Virtual Network, which is used to enable connection tracking for intra-VM flows. Possible values are between 4 and 30 minutes. Default value 0 will set the property to null."
+              }
+            },
+            "diagnosticSettings": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/diagnosticSettingFullType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The diagnostic settings of the service."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "roleAssignments": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/roleAssignmentType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "enableVmProtection": {
+              "type": "bool",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Indicates if VM protection is enabled for all the subnets in the virtual network."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "formattedRoleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+              }
+            ],
+            "enableReferencedModulesTelemetry": false,
+            "builtInRoleNames": {
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+            }
+          },
+          "resources": {
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.network-virtualnetwork.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "virtualNetwork": {
+              "type": "Microsoft.Network/virtualNetworks",
+              "apiVersion": "2024-01-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "properties": {
+                "addressSpace": {
+                  "addressPrefixes": "[parameters('addressPrefixes')]"
+                },
+                "bgpCommunities": "[if(not(empty(parameters('virtualNetworkBgpCommunity'))), createObject('virtualNetworkCommunity', parameters('virtualNetworkBgpCommunity')), null())]",
+                "ddosProtectionPlan": "[if(not(empty(parameters('ddosProtectionPlanResourceId'))), createObject('id', parameters('ddosProtectionPlanResourceId')), null())]",
+                "dhcpOptions": "[if(not(empty(parameters('dnsServers'))), createObject('dnsServers', array(parameters('dnsServers'))), null())]",
+                "enableDdosProtection": "[not(empty(parameters('ddosProtectionPlanResourceId')))]",
+                "encryption": "[if(equals(parameters('vnetEncryption'), true()), createObject('enabled', parameters('vnetEncryption'), 'enforcement', parameters('vnetEncryptionEnforcement')), null())]",
+                "flowTimeoutInMinutes": "[if(not(equals(parameters('flowTimeoutInMinutes'), 0)), parameters('flowTimeoutInMinutes'), null())]",
+                "enableVmProtection": "[parameters('enableVmProtection')]"
+              }
+            },
+            "virtualNetwork_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.Network/virtualNetworks/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "virtualNetwork"
+              ]
+            },
+            "virtualNetwork_diagnosticSettings": {
+              "copy": {
+                "name": "virtualNetwork_diagnosticSettings",
+                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+              },
+              "type": "Microsoft.Insights/diagnosticSettings",
+              "apiVersion": "2021-05-01-preview",
+              "scope": "[format('Microsoft.Network/virtualNetworks/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "metrics",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                    "input": {
+                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                      "timeGrain": null
+                    }
+                  },
+                  {
+                    "name": "logs",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                    "input": {
+                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                    }
+                  }
+                ],
+                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+              },
+              "dependsOn": [
+                "virtualNetwork"
+              ]
+            },
+            "virtualNetwork_roleAssignments": {
+              "copy": {
+                "name": "virtualNetwork_roleAssignments",
+                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.Network/virtualNetworks/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/virtualNetworks', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+              "properties": {
+                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "virtualNetwork"
+              ]
+            },
+            "virtualNetwork_subnets": {
+              "copy": {
+                "name": "virtualNetwork_subnets",
+                "count": "[length(coalesce(parameters('subnets'), createArray()))]",
+                "mode": "serial",
+                "batchSize": 1
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-subnet-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualNetworkName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('subnets'), createArray())[copyIndex()].name]"
+                  },
+                  "addressPrefix": {
+                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'addressPrefix')]"
+                  },
+                  "addressPrefixes": {
+                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'addressPrefixes')]"
+                  },
+                  "applicationGatewayIPConfigurations": {
+                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'applicationGatewayIPConfigurations')]"
+                  },
+                  "delegation": {
+                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'delegation')]"
+                  },
+                  "natGatewayResourceId": {
+                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'natGatewayResourceId')]"
+                  },
+                  "networkSecurityGroupResourceId": {
+                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'networkSecurityGroupResourceId')]"
+                  },
+                  "privateEndpointNetworkPolicies": {
+                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'privateEndpointNetworkPolicies')]"
+                  },
+                  "privateLinkServiceNetworkPolicies": {
+                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'privateLinkServiceNetworkPolicies')]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'roleAssignments')]"
+                  },
+                  "routeTableResourceId": {
+                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'routeTableResourceId')]"
+                  },
+                  "serviceEndpointPolicies": {
+                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'serviceEndpointPolicies')]"
+                  },
+                  "serviceEndpoints": {
+                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'serviceEndpoints')]"
+                  },
+                  "defaultOutboundAccess": {
+                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'defaultOutboundAccess')]"
+                  },
+                  "sharingScope": {
+                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'sharingScope')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.1.11899",
+                      "templateHash": "2692730101868032103"
+                    },
+                    "name": "Virtual Network Subnets",
+                    "description": "This module deploys a Virtual Network Subnet."
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The Name of the subnet resource."
+                      }
+                    },
+                    "virtualNetworkName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual network. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "addressPrefix": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Conditional. The address prefix for the subnet. Required if `addressPrefixes` is empty."
+                      }
+                    },
+                    "networkSecurityGroupResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resource ID of the network security group to assign to the subnet."
+                      }
+                    },
+                    "routeTableResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resource ID of the route table to assign to the subnet."
+                      }
+                    },
+                    "serviceEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. The service endpoints to enable on the subnet."
+                      }
+                    },
+                    "delegation": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The delegation to enable on the subnet."
+                      }
+                    },
+                    "natGatewayResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resource ID of the NAT Gateway to use for the subnet."
+                      }
+                    },
+                    "privateEndpointNetworkPolicies": {
+                      "type": "string",
+                      "nullable": true,
+                      "allowedValues": [
+                        "Disabled",
+                        "Enabled",
+                        "NetworkSecurityGroupEnabled",
+                        "RouteTableEnabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Enable or disable apply network policies on private endpoint in the subnet."
+                      }
+                    },
+                    "privateLinkServiceNetworkPolicies": {
+                      "type": "string",
+                      "nullable": true,
+                      "allowedValues": [
+                        "Disabled",
+                        "Enabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Enable or disable apply network policies on private link service in the subnet."
+                      }
+                    },
+                    "addressPrefixes": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Conditional. List of address prefixes for the subnet. Required if `addressPrefix` is empty."
+                      }
+                    },
+                    "defaultOutboundAccess": {
+                      "type": "bool",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Set this property to false to disable default outbound connectivity for all VMs in the subnet. This property can only be set at the time of subnet creation and cannot be updated for an existing subnet."
+                      }
+                    },
+                    "sharingScope": {
+                      "type": "string",
+                      "allowedValues": [
+                        "DelegatedServices",
+                        "Tenant"
+                      ],
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Set this property to Tenant to allow sharing the subnet with other subscriptions in your AAD tenant. This property can only be set if defaultOutboundAccess is set to false, both properties can only be set if the subnet is empty."
+                      }
+                    },
+                    "applicationGatewayIPConfigurations": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Application gateway IP configurations of virtual network resource."
+                      }
+                    },
+                    "serviceEndpointPolicies": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. An array of service endpoint policies."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.network-virtualnetworksubnet.{0}.{1}', replace('0.1.1', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "virtualNetwork": {
+                      "existing": true,
+                      "type": "Microsoft.Network/virtualNetworks",
+                      "apiVersion": "2024-01-01",
+                      "name": "[parameters('virtualNetworkName')]"
+                    },
+                    "subnet": {
+                      "type": "Microsoft.Network/virtualNetworks/subnets",
+                      "apiVersion": "2024-01-01",
+                      "name": "[format('{0}/{1}', parameters('virtualNetworkName'), parameters('name'))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "serviceEndpoints",
+                            "count": "[length(parameters('serviceEndpoints'))]",
+                            "input": {
+                              "service": "[parameters('serviceEndpoints')[copyIndex('serviceEndpoints')]]"
+                            }
+                          }
+                        ],
+                        "addressPrefix": "[parameters('addressPrefix')]",
+                        "addressPrefixes": "[parameters('addressPrefixes')]",
+                        "networkSecurityGroup": "[if(not(empty(parameters('networkSecurityGroupResourceId'))), createObject('id', parameters('networkSecurityGroupResourceId')), null())]",
+                        "routeTable": "[if(not(empty(parameters('routeTableResourceId'))), createObject('id', parameters('routeTableResourceId')), null())]",
+                        "natGateway": "[if(not(empty(parameters('natGatewayResourceId'))), createObject('id', parameters('natGatewayResourceId')), null())]",
+                        "delegations": "[if(not(empty(parameters('delegation'))), createArray(createObject('name', parameters('delegation'), 'properties', createObject('serviceName', parameters('delegation')))), createArray())]",
+                        "privateEndpointNetworkPolicies": "[parameters('privateEndpointNetworkPolicies')]",
+                        "privateLinkServiceNetworkPolicies": "[parameters('privateLinkServiceNetworkPolicies')]",
+                        "applicationGatewayIPConfigurations": "[parameters('applicationGatewayIPConfigurations')]",
+                        "serviceEndpointPolicies": "[parameters('serviceEndpointPolicies')]",
+                        "defaultOutboundAccess": "[parameters('defaultOutboundAccess')]",
+                        "sharingScope": "[parameters('sharingScope')]"
+                      }
+                    },
+                    "subnet_roleAssignments": {
+                      "copy": {
+                        "name": "subnet_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/virtualNetworks/{0}/subnets/{1}', parameters('virtualNetworkName'), parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "subnet"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the virtual network peering was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the virtual network peering."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the virtual network peering."
+                      },
+                      "value": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('name'))]"
+                    },
+                    "addressPrefix": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The address prefix for the subnet."
+                      },
+                      "value": "[coalesce(tryGet(reference('subnet'), 'addressPrefix'), '')]"
+                    },
+                    "addressPrefixes": {
+                      "type": "array",
+                      "metadata": {
+                        "description": "List of address prefixes for the subnet."
+                      },
+                      "value": "[coalesce(tryGet(reference('subnet'), 'addressPrefixes'), createArray())]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "virtualNetwork"
+              ]
+            },
+            "virtualNetwork_peering_local": {
+              "copy": {
+                "name": "virtualNetwork_peering_local",
+                "count": "[length(coalesce(parameters('peerings'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-virtualNetworkPeering-local-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "localVnetName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "remoteVirtualNetworkResourceId": {
+                    "value": "[coalesce(parameters('peerings'), createArray())[copyIndex()].remoteVirtualNetworkResourceId]"
+                  },
+                  "name": {
+                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'name')]"
+                  },
+                  "allowForwardedTraffic": {
+                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'allowForwardedTraffic')]"
+                  },
+                  "allowGatewayTransit": {
+                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'allowGatewayTransit')]"
+                  },
+                  "allowVirtualNetworkAccess": {
+                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'allowVirtualNetworkAccess')]"
+                  },
+                  "doNotVerifyRemoteGateways": {
+                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'doNotVerifyRemoteGateways')]"
+                  },
+                  "useRemoteGateways": {
+                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'useRemoteGateways')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.1.11899",
+                      "templateHash": "7728525434782883754"
+                    },
+                    "name": "Virtual Network Peerings",
+                    "description": "This module deploys a Virtual Network Peering."
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('peer-{0}-{1}', parameters('localVnetName'), last(split(parameters('remoteVirtualNetworkResourceId'), '/')))]",
+                      "metadata": {
+                        "description": "Optional. The Name of VNET Peering resource. If not provided, default value will be localVnetName-remoteVnetName."
+                      }
+                    },
+                    "localVnetName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Virtual Network to add the peering to. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "remoteVirtualNetworkResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The Resource ID of the VNet that is this Local VNet is being peered to. Should be in the format of a Resource ID."
+                      }
+                    },
+                    "allowForwardedTraffic": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Whether the forwarded traffic from the VMs in the local virtual network will be allowed/disallowed in remote virtual network. Default is true."
+                      }
+                    },
+                    "allowGatewayTransit": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. If gateway links can be used in remote virtual networking to link to this virtual network. Default is false."
+                      }
+                    },
+                    "allowVirtualNetworkAccess": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Whether the VMs in the local virtual network space would be able to access the VMs in remote virtual network space. Default is true."
+                      }
+                    },
+                    "doNotVerifyRemoteGateways": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. If we need to verify the provisioning state of the remote gateway. Default is true."
+                      }
+                    },
+                    "useRemoteGateways": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. If remote gateways can be used on this virtual network. If the flag is set to true, and allowGatewayTransit on remote peering is also true, virtual network will use gateways of remote virtual network for transit. Only one peering can have this flag set to true. This flag cannot be set if virtual network already has a gateway. Default is false."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",
+                      "apiVersion": "2024-01-01",
+                      "name": "[format('{0}/{1}', parameters('localVnetName'), parameters('name'))]",
+                      "properties": {
+                        "allowForwardedTraffic": "[parameters('allowForwardedTraffic')]",
+                        "allowGatewayTransit": "[parameters('allowGatewayTransit')]",
+                        "allowVirtualNetworkAccess": "[parameters('allowVirtualNetworkAccess')]",
+                        "doNotVerifyRemoteGateways": "[parameters('doNotVerifyRemoteGateways')]",
+                        "useRemoteGateways": "[parameters('useRemoteGateways')]",
+                        "remoteVirtualNetwork": {
+                          "id": "[parameters('remoteVirtualNetworkResourceId')]"
+                        }
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the virtual network peering was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the virtual network peering."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the virtual network peering."
+                      },
+                      "value": "[resourceId('Microsoft.Network/virtualNetworks/virtualNetworkPeerings', parameters('localVnetName'), parameters('name'))]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "virtualNetwork",
+                "virtualNetwork_subnets"
+              ]
+            },
+            "virtualNetwork_peering_remote": {
+              "copy": {
+                "name": "virtualNetwork_peering_remote",
+                "count": "[length(coalesce(parameters('peerings'), createArray()))]"
+              },
+              "condition": "[coalesce(tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringEnabled'), false())]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-virtualNetworkPeering-remote-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "subscriptionId": "[split(coalesce(parameters('peerings'), createArray())[copyIndex()].remoteVirtualNetworkResourceId, '/')[2]]",
+              "resourceGroup": "[split(coalesce(parameters('peerings'), createArray())[copyIndex()].remoteVirtualNetworkResourceId, '/')[4]]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "localVnetName": {
+                    "value": "[last(split(coalesce(parameters('peerings'), createArray())[copyIndex()].remoteVirtualNetworkResourceId, '/'))]"
+                  },
+                  "remoteVirtualNetworkResourceId": {
+                    "value": "[resourceId('Microsoft.Network/virtualNetworks', parameters('name'))]"
+                  },
+                  "name": {
+                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringName')]"
+                  },
+                  "allowForwardedTraffic": {
+                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringAllowForwardedTraffic')]"
+                  },
+                  "allowGatewayTransit": {
+                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringAllowGatewayTransit')]"
+                  },
+                  "allowVirtualNetworkAccess": {
+                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringAllowVirtualNetworkAccess')]"
+                  },
+                  "doNotVerifyRemoteGateways": {
+                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringDoNotVerifyRemoteGateways')]"
+                  },
+                  "useRemoteGateways": {
+                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringUseRemoteGateways')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.1.11899",
+                      "templateHash": "7728525434782883754"
+                    },
+                    "name": "Virtual Network Peerings",
+                    "description": "This module deploys a Virtual Network Peering."
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('peer-{0}-{1}', parameters('localVnetName'), last(split(parameters('remoteVirtualNetworkResourceId'), '/')))]",
+                      "metadata": {
+                        "description": "Optional. The Name of VNET Peering resource. If not provided, default value will be localVnetName-remoteVnetName."
+                      }
+                    },
+                    "localVnetName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Virtual Network to add the peering to. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "remoteVirtualNetworkResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The Resource ID of the VNet that is this Local VNet is being peered to. Should be in the format of a Resource ID."
+                      }
+                    },
+                    "allowForwardedTraffic": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Whether the forwarded traffic from the VMs in the local virtual network will be allowed/disallowed in remote virtual network. Default is true."
+                      }
+                    },
+                    "allowGatewayTransit": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. If gateway links can be used in remote virtual networking to link to this virtual network. Default is false."
+                      }
+                    },
+                    "allowVirtualNetworkAccess": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Whether the VMs in the local virtual network space would be able to access the VMs in remote virtual network space. Default is true."
+                      }
+                    },
+                    "doNotVerifyRemoteGateways": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. If we need to verify the provisioning state of the remote gateway. Default is true."
+                      }
+                    },
+                    "useRemoteGateways": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. If remote gateways can be used on this virtual network. If the flag is set to true, and allowGatewayTransit on remote peering is also true, virtual network will use gateways of remote virtual network for transit. Only one peering can have this flag set to true. This flag cannot be set if virtual network already has a gateway. Default is false."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",
+                      "apiVersion": "2024-01-01",
+                      "name": "[format('{0}/{1}', parameters('localVnetName'), parameters('name'))]",
+                      "properties": {
+                        "allowForwardedTraffic": "[parameters('allowForwardedTraffic')]",
+                        "allowGatewayTransit": "[parameters('allowGatewayTransit')]",
+                        "allowVirtualNetworkAccess": "[parameters('allowVirtualNetworkAccess')]",
+                        "doNotVerifyRemoteGateways": "[parameters('doNotVerifyRemoteGateways')]",
+                        "useRemoteGateways": "[parameters('useRemoteGateways')]",
+                        "remoteVirtualNetwork": {
+                          "id": "[parameters('remoteVirtualNetworkResourceId')]"
+                        }
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the virtual network peering was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the virtual network peering."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the virtual network peering."
+                      },
+                      "value": "[resourceId('Microsoft.Network/virtualNetworks/virtualNetworkPeerings', parameters('localVnetName'), parameters('name'))]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "virtualNetwork",
+                "virtualNetwork_subnets"
+              ]
+            }
+          },
+          "outputs": {
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group the virtual network was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the virtual network."
+              },
+              "value": "[resourceId('Microsoft.Network/virtualNetworks', parameters('name'))]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the virtual network."
+              },
+              "value": "[parameters('name')]"
+            },
+            "subnetNames": {
+              "type": "array",
+              "metadata": {
+                "description": "The names of the deployed subnets."
+              },
+              "copy": {
+                "count": "[length(coalesce(parameters('subnets'), createArray()))]",
+                "input": "[reference(format('virtualNetwork_subnets[{0}]', copyIndex())).outputs.name.value]"
+              }
+            },
+            "subnetResourceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The resource IDs of the deployed subnets."
+              },
+              "copy": {
+                "count": "[length(coalesce(parameters('subnets'), createArray()))]",
+                "input": "[reference(format('virtualNetwork_subnets[{0}]', copyIndex())).outputs.resourceId.value]"
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('virtualNetwork', '2024-01-01', 'full').location]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "networkSecurityGroupAdministration",
+        "networkSecurityGroupBackend",
+        "networkSecurityGroupBastion",
+        "networkSecurityGroupContainers"
+      ]
+    },
+    "bastionHost": {
+      "condition": "[and(variables('virtualNetworkEnabled'), variables('bastionEnabled'))]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('avm.res.network.bastion-host.{0}', variables('bastionResourceName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[variables('bastionResourceName')]"
+          },
+          "location": {
+            "value": "[coalesce(tryGet(parameters('bastionConfiguration'), 'location'), parameters('solutionLocation'))]"
+          },
+          "skuName": {
+            "value": "[coalesce(tryGet(parameters('bastionConfiguration'), 'sku'), 'Standard')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "tags": {
+            "value": "[coalesce(tryGet(parameters('bastionConfiguration'), 'tags'), parameters('tags'))]"
+          },
+          "virtualNetworkResourceId": {
+            "value": "[coalesce(tryGet(parameters('bastionConfiguration'), 'virtualNetworkResourceId'), tryGet(tryGet(tryGet(reference('virtualNetwork'), 'outputs'), 'resourceId'), 'value'))]"
+          },
+          "publicIPAddressObject": {
+            "value": {
+              "name": "[coalesce(tryGet(parameters('bastionConfiguration'), 'publicIpResourceName'), format('pip-bas{0}', parameters('solutionPrefix')))]"
+            }
+          },
+          "disableCopyPaste": {
+            "value": false
+          },
+          "enableFileCopy": {
+            "value": false
+          },
+          "enableIpConnect": {
+            "value": true
+          },
+          "enableShareableLink": {
+            "value": true
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.33.93.31351",
+              "templateHash": "2586599138991803385"
+            },
+            "name": "Bastion Hosts",
+            "description": "This module deploys a Bastion Host."
+          },
+          "definitions": {
+            "diagnosticSettingLogsOnlyType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of diagnostic setting."
+                  }
+                },
+                "logCategoriesAndGroups": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "category": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                        }
+                      },
+                      "categoryGroup": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                        }
+                      },
+                      "enabled": {
+                        "type": "bool",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                  }
+                },
+                "logAnalyticsDestinationType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "AzureDiagnostics",
+                    "Dedicated"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                  }
+                },
+                "workspaceResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "storageAccountResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "eventHubAuthorizationRuleResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                  }
+                },
+                "eventHubName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "marketplacePartnerResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a diagnostic setting. To be used if only logs are supported by the resource provider.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a lock.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "roleAssignmentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                  }
+                },
+                "roleDefinitionIdOrName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                  }
+                },
+                "principalId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                  }
+                },
+                "principalType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Device",
+                    "ForeignGroup",
+                    "Group",
+                    "ServicePrincipal",
+                    "User"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The principal type of the assigned principal ID."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The description of the role assignment."
+                  }
+                },
+                "condition": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                  }
+                },
+                "conditionVersion": {
+                  "type": "string",
+                  "allowedValues": [
+                    "2.0"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Version of the condition."
+                  }
+                },
+                "delegatedManagedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a role assignment.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name of the Azure Bastion resource."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all resources."
+              }
+            },
+            "virtualNetworkResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Shared services Virtual Network resource Id."
+              }
+            },
+            "bastionSubnetPublicIpResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. The Public IP resource ID to associate to the azureBastionSubnet. If empty, then the Public IP that is created as part of this module will be applied to the azureBastionSubnet. This parameter is ignored when enablePrivateOnlyBastion is true."
+              }
+            },
+            "publicIPAddressObject": {
+              "type": "object",
+              "defaultValue": {
+                "name": "[format('{0}-pip', parameters('name'))]"
+              },
+              "metadata": {
+                "description": "Optional. Specifies the properties of the Public IP to create and be used by Azure Bastion, if no existing public IP was provided. This parameter is ignored when enablePrivateOnlyBastion is true."
+              }
+            },
+            "diagnosticSettings": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/diagnosticSettingLogsOnlyType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The diagnostic settings of the service."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "skuName": {
+              "type": "string",
+              "defaultValue": "Basic",
+              "allowedValues": [
+                "Basic",
+                "Developer",
+                "Premium",
+                "Standard"
+              ],
+              "metadata": {
+                "description": "Optional. The SKU of this Bastion Host."
+              }
+            },
+            "disableCopyPaste": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Choose to disable or enable Copy Paste. For Basic and Developer SKU Copy/Paste is always enabled."
+              }
+            },
+            "enableFileCopy": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Choose to disable or enable File Copy. Not supported for Basic and Developer SKU."
+              }
+            },
+            "enableIpConnect": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Choose to disable or enable IP Connect. Not supported for Basic and Developer SKU."
+              }
+            },
+            "enableKerberos": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Choose to disable or enable Kerberos authentication. Not supported for Developer SKU."
+              }
+            },
+            "enableShareableLink": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Choose to disable or enable Shareable Link. Not supported for Basic and Developer SKU."
+              }
+            },
+            "enableSessionRecording": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Choose to disable or enable Session Recording feature. The Premium SKU is required for this feature. If Session Recording is enabled, the Native client support will be disabled."
+              }
+            },
+            "enablePrivateOnlyBastion": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Choose to disable or enable Private-only Bastion deployment. The Premium SKU is required for this feature."
+              }
+            },
+            "scaleUnits": {
+              "type": "int",
+              "defaultValue": 2,
+              "metadata": {
+                "description": "Optional. The scale units for the Bastion Host resource. The Basic and Developer SKU only support 2 scale units."
+              }
+            },
+            "roleAssignments": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/roleAssignmentType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "zones": {
+              "type": "array",
+              "items": {
+                "type": "int"
+              },
+              "defaultValue": [],
+              "allowedValues": [
+                1,
+                2,
+                3
+              ],
+              "metadata": {
+                "description": "Optional. A list of availability zones denoting where the Bastion Host resource needs to come from. This is not supported for the Developer SKU."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "formattedRoleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+              }
+            ],
+            "enableReferencedModulesTelemetry": false,
+            "builtInRoleNames": {
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+            }
+          },
+          "resources": {
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.network-bastionhost.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "azureBastion": {
+              "type": "Microsoft.Network/bastionHosts",
+              "apiVersion": "2024-05-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[coalesce(parameters('tags'), createObject())]",
+              "sku": {
+                "name": "[parameters('skuName')]"
+              },
+              "zones": "[if(equals(parameters('skuName'), 'Developer'), createArray(), map(parameters('zones'), lambda('zone', string(lambdaVariables('zone')))))]",
+              "properties": "[union(createObject('scaleUnits', if(or(equals(parameters('skuName'), 'Basic'), equals(parameters('skuName'), 'Developer')), 2, parameters('scaleUnits')), 'ipConfigurations', if(equals(parameters('skuName'), 'Developer'), createArray(), createArray(createObject('name', 'IpConfAzureBastionSubnet', 'properties', union(createObject('subnet', createObject('id', format('{0}/subnets/AzureBastionSubnet', parameters('virtualNetworkResourceId')))), if(not(parameters('enablePrivateOnlyBastion')), createObject('publicIPAddress', createObject('id', if(not(empty(parameters('bastionSubnetPublicIpResourceId'))), parameters('bastionSubnetPublicIpResourceId'), reference('publicIPAddress').outputs.resourceId.value))), createObject())))))), if(equals(parameters('skuName'), 'Developer'), createObject('virtualNetwork', createObject('id', parameters('virtualNetworkResourceId'))), createObject()), if(or(or(equals(parameters('skuName'), 'Basic'), equals(parameters('skuName'), 'Standard')), equals(parameters('skuName'), 'Premium')), createObject('enableKerberos', parameters('enableKerberos')), createObject()), if(or(equals(parameters('skuName'), 'Standard'), equals(parameters('skuName'), 'Premium')), createObject('enableTunneling', if(equals(parameters('skuName'), 'Standard'), true(), if(parameters('enableSessionRecording'), false(), true())), 'disableCopyPaste', parameters('disableCopyPaste'), 'enableFileCopy', parameters('enableFileCopy'), 'enableIpConnect', parameters('enableIpConnect'), 'enableShareableLink', parameters('enableShareableLink')), createObject()), if(equals(parameters('skuName'), 'Premium'), createObject('enableSessionRecording', parameters('enableSessionRecording'), 'enablePrivateOnlyBastion', parameters('enablePrivateOnlyBastion')), createObject()))]",
+              "dependsOn": [
+                "publicIPAddress"
+              ]
+            },
+            "azureBastion_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.Network/bastionHosts/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "azureBastion"
+              ]
+            },
+            "azureBastion_diagnosticSettings": {
+              "copy": {
+                "name": "azureBastion_diagnosticSettings",
+                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+              },
+              "type": "Microsoft.Insights/diagnosticSettings",
+              "apiVersion": "2021-05-01-preview",
+              "scope": "[format('Microsoft.Network/bastionHosts/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "logs",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                    "input": {
+                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                    }
+                  }
+                ],
+                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+              },
+              "dependsOn": [
+                "azureBastion"
+              ]
+            },
+            "azureBastion_roleAssignments": {
+              "copy": {
+                "name": "azureBastion_roleAssignments",
+                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.Network/bastionHosts/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/bastionHosts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+              "properties": {
+                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "azureBastion"
+              ]
+            },
+            "publicIPAddress": {
+              "condition": "[and(and(empty(parameters('bastionSubnetPublicIpResourceId')), not(equals(parameters('skuName'), 'Developer'))), not(parameters('enablePrivateOnlyBastion')))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Bastion-PIP', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('publicIPAddressObject').name]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "lock": {
+                    "value": "[parameters('lock')]"
+                  },
+                  "diagnosticSettings": {
+                    "value": "[tryGet(parameters('publicIPAddressObject'), 'diagnosticSettings')]"
+                  },
+                  "publicIPAddressVersion": {
+                    "value": "[tryGet(parameters('publicIPAddressObject'), 'publicIPAddressVersion')]"
+                  },
+                  "publicIPAllocationMethod": {
+                    "value": "[tryGet(parameters('publicIPAddressObject'), 'publicIPAllocationMethod')]"
+                  },
+                  "publicIpPrefixResourceId": {
+                    "value": "[tryGet(parameters('publicIPAddressObject'), 'publicIPPrefixResourceId')]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(parameters('publicIPAddressObject'), 'roleAssignments')]"
+                  },
+                  "skuName": {
+                    "value": "[tryGet(parameters('publicIPAddressObject'), 'skuName')]"
+                  },
+                  "skuTier": {
+                    "value": "[tryGet(parameters('publicIPAddressObject'), 'skuTier')]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('publicIPAddressObject'), 'tags'), parameters('tags'))]"
+                  },
+                  "zones": {
+                    "value": "[coalesce(tryGet(parameters('publicIPAddressObject'), 'zones'), if(greater(length(parameters('zones')), 0), parameters('zones'), null()))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.33.93.31351",
+                      "templateHash": "5168739580767459761"
+                    },
+                    "name": "Public IP Addresses",
+                    "description": "This module deploys a Public IP Address."
+                  },
+                  "definitions": {
+                    "dnsSettingsType": {
+                      "type": "object",
+                      "properties": {
+                        "domainNameLabel": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The domain name label. The concatenation of the domain name label and the regionalized DNS zone make up the fully qualified domain name associated with the public IP address. If a domain name label is specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system."
+                          }
+                        },
+                        "domainNameLabelScope": {
+                          "type": "string",
+                          "allowedValues": [
+                            "NoReuse",
+                            "ResourceGroupReuse",
+                            "SubscriptionReuse",
+                            "TenantReuse"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The domain name label scope. If a domain name label and a domain name label scope are specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system with a hashed value includes in FQDN."
+                          }
+                        },
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Fully Qualified Domain Name of the A DNS record associated with the public IP. This is the concatenation of the domainNameLabel and the regionalized DNS zone."
+                          }
+                        },
+                        "reverseFqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The reverse FQDN. A user-visible, fully qualified domain name that resolves to this public IP address. If the reverseFqdn is specified, then a PTR DNS record is created pointing from the IP address in the in-addr.arpa domain to the reverse FQDN."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "ddosSettingsType": {
+                      "type": "object",
+                      "properties": {
+                        "ddosProtectionPlan": {
+                          "type": "object",
+                          "properties": {
+                            "id": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The resource ID of the DDOS protection plan associated with the public IP address."
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The DDoS protection plan associated with the public IP address."
+                          }
+                        },
+                        "protectionMode": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Enabled"
+                          ],
+                          "metadata": {
+                            "description": "Required. The DDoS protection policy customizations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "ipTagType": {
+                      "type": "object",
+                      "properties": {
+                        "ipTagType": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The IP tag type."
+                          }
+                        },
+                        "tag": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The IP tag."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "diagnosticSettingFullType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the Public IP Address."
+                      }
+                    },
+                    "publicIpPrefixResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Resource ID of the Public IP Prefix object. This is only needed if you want your Public IPs created in a PIP Prefix."
+                      }
+                    },
+                    "publicIPAllocationMethod": {
+                      "type": "string",
+                      "defaultValue": "Static",
+                      "allowedValues": [
+                        "Dynamic",
+                        "Static"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The public IP address allocation method."
+                      }
+                    },
+                    "zones": {
+                      "type": "array",
+                      "items": {
+                        "type": "int"
+                      },
+                      "defaultValue": [
+                        1,
+                        2,
+                        3
+                      ],
+                      "allowedValues": [
+                        1,
+                        2,
+                        3
+                      ],
+                      "metadata": {
+                        "description": "Optional. A list of availability zones denoting the IP allocated for the resource needs to come from."
+                      }
+                    },
+                    "publicIPAddressVersion": {
+                      "type": "string",
+                      "defaultValue": "IPv4",
+                      "allowedValues": [
+                        "IPv4",
+                        "IPv6"
+                      ],
+                      "metadata": {
+                        "description": "Optional. IP address version."
+                      }
+                    },
+                    "dnsSettings": {
+                      "$ref": "#/definitions/dnsSettingsType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The DNS settings of the public IP address."
+                      }
+                    },
+                    "ipTags": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/ipTagType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The list of tags associated with the public IP address."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "Standard",
+                      "allowedValues": [
+                        "Basic",
+                        "Standard"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Name of a public IP address SKU."
+                      }
+                    },
+                    "skuTier": {
+                      "type": "string",
+                      "defaultValue": "Regional",
+                      "allowedValues": [
+                        "Global",
+                        "Regional"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Tier of a public IP address SKU."
+                      }
+                    },
+                    "ddosSettings": {
+                      "$ref": "#/definitions/ddosSettingsType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The DDoS protection plan configuration associated with the public IP address."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "idleTimeoutInMinutes": {
+                      "type": "int",
+                      "defaultValue": 4,
+                      "metadata": {
+                        "description": "Optional. The idle timeout of the public IP address."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingFullType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.network-publicipaddress.{0}.{1}', replace('0.8.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "publicIpAddress": {
+                      "type": "Microsoft.Network/publicIPAddresses",
+                      "apiVersion": "2024-05-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "sku": {
+                        "name": "[parameters('skuName')]",
+                        "tier": "[parameters('skuTier')]"
+                      },
+                      "zones": "[map(parameters('zones'), lambda('zone', string(lambdaVariables('zone'))))]",
+                      "properties": {
+                        "ddosSettings": "[parameters('ddosSettings')]",
+                        "dnsSettings": "[parameters('dnsSettings')]",
+                        "publicIPAddressVersion": "[parameters('publicIPAddressVersion')]",
+                        "publicIPAllocationMethod": "[parameters('publicIPAllocationMethod')]",
+                        "publicIPPrefix": "[if(not(empty(parameters('publicIpPrefixResourceId'))), createObject('id', parameters('publicIpPrefixResourceId')), null())]",
+                        "idleTimeoutInMinutes": "[parameters('idleTimeoutInMinutes')]",
+                        "ipTags": "[parameters('ipTags')]"
+                      }
+                    },
+                    "publicIpAddress_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "publicIpAddress"
+                      ]
+                    },
+                    "publicIpAddress_roleAssignments": {
+                      "copy": {
+                        "name": "publicIpAddress_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/publicIPAddresses', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "publicIpAddress"
+                      ]
+                    },
+                    "publicIpAddress_diagnosticSettings": {
+                      "copy": {
+                        "name": "publicIpAddress_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "publicIpAddress"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the public IP address was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the public IP address."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the public IP address."
+                      },
+                      "value": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('name'))]"
+                    },
+                    "ipAddress": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The public IP address of the public IP address resource."
+                      },
+                      "value": "[coalesce(tryGet(reference('publicIpAddress'), 'ipAddress'), '')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('publicIpAddress', '2024-05-01', 'full').location]"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "outputs": {
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group the Azure Bastion was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name the Azure Bastion."
+              },
+              "value": "[parameters('name')]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID the Azure Bastion."
+              },
+              "value": "[resourceId('Microsoft.Network/bastionHosts', parameters('name'))]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('azureBastion', '2024-05-01', 'full').location]"
+            },
+            "ipConfAzureBastionSubnet": {
+              "type": "object",
+              "metadata": {
+                "description": "The Public IPconfiguration object for the AzureBastionSubnet."
+              },
+              "value": "[if(equals(parameters('skuName'), 'Developer'), createObject(), reference('azureBastion').ipConfigurations[0])]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "virtualNetwork"
+      ]
+    },
+    "virtualMachine": {
+      "condition": "[and(variables('virtualNetworkEnabled'), variables('virtualMachineEnabled'))]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('avm.res.compute.virtual-machine.{0}', variables('virtualMachineResourceName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[variables('virtualMachineResourceName')]"
+          },
+          "computerName": {
+            "value": "[take(variables('virtualMachineResourceName'), 15)]"
+          },
+          "location": {
+            "value": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'location'), parameters('solutionLocation'))]"
+          },
+          "tags": {
+            "value": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'tags'), parameters('tags'))]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "vmSize": {
+            "value": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'vmSize'), 'Standard_D2s_v3')]"
+          },
+          "adminUsername": {
+            "value": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'adminUsername'), 'adminuser')]"
+          },
+          "adminPassword": {
+            "value": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'adminPassword'), guid(parameters('solutionPrefix'), subscription().subscriptionId))]"
+          },
+          "nicConfigurations": {
+            "value": [
+              {
+                "name": "[format('nic-{0}', variables('virtualMachineResourceName'))]",
+                "diagnosticSettings": [
+                  {
+                    "workspaceResourceId": "[if(variables('useExistingWorkspace'), variables('existingWorkspaceResourceId'), listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId)]"
+                  }
+                ],
+                "ipConfigurations": [
+                  {
+                    "name": "[format('{0}-nic01-ipconfig01', variables('virtualMachineResourceName'))]",
+                    "subnetResourceId": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'subnetResourceId'), reference('virtualNetwork').outputs.subnetResourceIds.value[1])]",
+                    "diagnosticSettings": [
+                      {
+                        "workspaceResourceId": "[if(variables('useExistingWorkspace'), variables('existingWorkspaceResourceId'), listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId)]"
+                      }
+                    ]
+                  }
+                ]
+              }
+            ]
+          },
+          "imageReference": {
+            "value": {
+              "publisher": "microsoft-dsvm",
+              "offer": "dsvm-win-2022",
+              "sku": "winserver-2022",
+              "version": "latest"
+            }
+          },
+          "osDisk": {
+            "value": {
+              "name": "[format('osdisk-{0}', variables('virtualMachineResourceName'))]",
+              "createOption": "FromImage",
+              "managedDisk": {
+                "storageAccountType": "Premium_ZRS"
+              },
+              "diskSizeGB": 128,
+              "caching": "ReadWrite"
+            }
+          },
+          "osType": {
+            "value": "Windows"
+          },
+          "encryptionAtHost": {
+            "value": false
+          },
+          "zone": {
+            "value": 0
+          },
+          "extensionAadJoinConfig": {
+            "value": {
+              "enabled": true,
+              "typeHandlerVersion": "1.0"
+            }
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.34.44.8038",
+              "templateHash": "13105916093025105823"
+            },
+            "name": "Virtual Machines",
+            "description": "This module deploys a Virtual Machine with one or multiple NICs and optionally one or multiple public IPs."
+          },
+          "definitions": {
+            "osDiskType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The disk name."
+                  }
+                },
+                "diskSizeGB": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specifies the size of an empty data disk in gigabytes."
+                  }
+                },
+                "createOption": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Attach",
+                    "Empty",
+                    "FromImage"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specifies how the virtual machine should be created."
+                  }
+                },
+                "deleteOption": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Delete",
+                    "Detach"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specifies whether data disk should be deleted or detached upon VM deletion."
+                  }
+                },
+                "caching": {
+                  "type": "string",
+                  "allowedValues": [
+                    "None",
+                    "ReadOnly",
+                    "ReadWrite"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specifies the caching requirements."
+                  }
+                },
+                "diffDiskSettings": {
+                  "type": "object",
+                  "properties": {
+                    "placement": {
+                      "type": "string",
+                      "allowedValues": [
+                        "CacheDisk",
+                        "NvmeDisk",
+                        "ResourceDisk"
+                      ],
+                      "metadata": {
+                        "description": "Required. Specifies the ephemeral disk placement for the operating system disk."
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specifies the ephemeral Disk Settings for the operating system disk."
+                  }
+                },
+                "managedDisk": {
+                  "type": "object",
+                  "properties": {
+                    "storageAccountType": {
+                      "type": "string",
+                      "allowedValues": [
+                        "PremiumV2_LRS",
+                        "Premium_LRS",
+                        "Premium_ZRS",
+                        "StandardSSD_LRS",
+                        "StandardSSD_ZRS",
+                        "Standard_LRS",
+                        "UltraSSD_LRS"
+                      ],
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Specifies the storage account type for the managed disk."
+                      }
+                    },
+                    "diskEncryptionSetResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Specifies the customer managed disk encryption set resource id for the managed disk."
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. The managed disk parameters."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type describing an OS disk."
+              }
+            },
+            "dataDiskType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The disk name."
+                  }
+                },
+                "lun": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specifies the logical unit number of the data disk."
+                  }
+                },
+                "diskSizeGB": {
+                  "type": "int",
+                  "metadata": {
+                    "description": "Required. Specifies the size of an empty data disk in gigabytes."
+                  }
+                },
+                "createOption": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Attach",
+                    "Empty",
+                    "FromImage"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specifies how the virtual machine should be created."
+                  }
+                },
+                "deleteOption": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Delete",
+                    "Detach"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specifies whether data disk should be deleted or detached upon VM deletion."
+                  }
+                },
+                "caching": {
+                  "type": "string",
+                  "allowedValues": [
+                    "None",
+                    "ReadOnly",
+                    "ReadWrite"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specifies the caching requirements."
+                  }
+                },
+                "diskIOPSReadWrite": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The number of IOPS allowed for this disk; only settable for UltraSSD disks. One operation can transfer between 4k and 256k bytes."
+                  }
+                },
+                "diskMBpsReadWrite": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The bandwidth allowed for this disk; only settable for UltraSSD disks. MBps means millions of bytes per second - MB here uses the ISO notation, of powers of 10."
+                  }
+                },
+                "managedDisk": {
+                  "type": "object",
+                  "properties": {
+                    "storageAccountType": {
+                      "type": "string",
+                      "allowedValues": [
+                        "PremiumV2_LRS",
+                        "Premium_LRS",
+                        "Premium_ZRS",
+                        "StandardSSD_LRS",
+                        "StandardSSD_ZRS",
+                        "Standard_LRS",
+                        "UltraSSD_LRS"
+                      ],
+                      "metadata": {
+                        "description": "Required. Specifies the storage account type for the managed disk."
+                      }
+                    },
+                    "diskEncryptionSetResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Specifies the customer managed disk encryption set resource id for the managed disk."
+                      }
+                    },
+                    "id": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Specifies the customer managed disk id for the managed disk."
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. The managed disk parameters."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type describing a data disk."
+              }
+            },
+            "publicKeyType": {
+              "type": "object",
+              "properties": {
+                "keyData": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Specifies the SSH public key data used to authenticate through ssh."
+                  }
+                },
+                "path": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Specifies the full path on the created VM where ssh public key is stored. If the file already exists, the specified key is appended to the file."
+                  }
+                }
+              }
+            },
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a lock.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "managedIdentityAllType": {
+              "type": "object",
+              "properties": {
+                "systemAssigned": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enables system assigned managed identity on the resource."
+                  }
+                },
+                "userAssignedResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "roleAssignmentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                  }
+                },
+                "roleDefinitionIdOrName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                  }
+                },
+                "principalId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                  }
+                },
+                "principalType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Device",
+                    "ForeignGroup",
+                    "Group",
+                    "ServicePrincipal",
+                    "User"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The principal type of the assigned principal ID."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The description of the role assignment."
+                  }
+                },
+                "condition": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                  }
+                },
+                "conditionVersion": {
+                  "type": "string",
+                  "allowedValues": [
+                    "2.0"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Version of the condition."
+                  }
+                },
+                "delegatedManagedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a role assignment.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. The name of the virtual machine to be created. You should use a unique prefix to reduce name collisions in Active Directory."
+              }
+            },
+            "computerName": {
+              "type": "string",
+              "defaultValue": "[parameters('name')]",
+              "metadata": {
+                "description": "Optional. Can be used if the computer name needs to be different from the Azure VM resource name. If not used, the resource name will be used as computer name."
+              }
+            },
+            "vmSize": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Specifies the size for the VMs."
+              }
+            },
+            "encryptionAtHost": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. This property can be used by user in the request to enable or disable the Host Encryption for the virtual machine. This will enable the encryption for all the disks including Resource/Temp disk at host itself. For security reasons, it is recommended to set encryptionAtHost to True. Restrictions: Cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs."
+              }
+            },
+            "securityType": {
+              "type": "string",
+              "defaultValue": "",
+              "allowedValues": [
+                "",
+                "ConfidentialVM",
+                "TrustedLaunch"
+              ],
+              "metadata": {
+                "description": "Optional. Specifies the SecurityType of the virtual machine. It has to be set to any specified value to enable UefiSettings. The default behavior is: UefiSettings will not be enabled unless this property is set."
+              }
+            },
+            "secureBootEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Specifies whether secure boot should be enabled on the virtual machine. This parameter is part of the UefiSettings. SecurityType should be set to TrustedLaunch to enable UefiSettings."
+              }
+            },
+            "vTpmEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Specifies whether vTPM should be enabled on the virtual machine. This parameter is part of the UefiSettings.  SecurityType should be set to TrustedLaunch to enable UefiSettings."
+              }
+            },
+            "imageReference": {
+              "type": "object",
+              "metadata": {
+                "description": "Required. OS image reference. In case of marketplace images, it's the combination of the publisher, offer, sku, version attributes. In case of custom images it's the resource ID of the custom image."
+              }
+            },
+            "plan": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. Specifies information about the marketplace image used to create the virtual machine. This element is only used for marketplace images. Before you can use a marketplace image from an API, you must enable the image for programmatic use."
+              }
+            },
+            "osDisk": {
+              "$ref": "#/definitions/osDiskType",
+              "metadata": {
+                "description": "Required. Specifies the OS disk. For security reasons, it is recommended to specify DiskEncryptionSet into the osDisk object.  Restrictions: DiskEncryptionSet cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs."
+              }
+            },
+            "dataDisks": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/dataDiskType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Specifies the data disks. For security reasons, it is recommended to specify DiskEncryptionSet into the dataDisk object. Restrictions: DiskEncryptionSet cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs."
+              }
+            },
+            "ultraSSDEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. The flag that enables or disables a capability to have one or more managed data disks with UltraSSD_LRS storage account type on the VM or VMSS. Managed disks with storage account type UltraSSD_LRS can be added to a virtual machine or virtual machine scale set only if this property is enabled."
+              }
+            },
+            "adminUsername": {
+              "type": "securestring",
+              "metadata": {
+                "description": "Required. Administrator username."
+              }
+            },
+            "adminPassword": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. When specifying a Windows Virtual Machine, this value should be passed."
+              }
+            },
+            "userData": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. UserData for the VM, which must be base-64 encoded. Customer should not pass any secrets in here."
+              }
+            },
+            "customData": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Custom data associated to the VM, this value will be automatically converted into base64 to account for the expected VM format."
+              }
+            },
+            "certificatesToBeInstalled": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. Specifies set of certificates that should be installed onto the virtual machine."
+              }
+            },
+            "priority": {
+              "type": "string",
+              "defaultValue": "Regular",
+              "allowedValues": [
+                "Regular",
+                "Low",
+                "Spot"
+              ],
+              "metadata": {
+                "description": "Optional. Specifies the priority for the virtual machine."
+              }
+            },
+            "evictionPolicy": {
+              "type": "string",
+              "defaultValue": "Deallocate",
+              "allowedValues": [
+                "Deallocate",
+                "Delete"
+              ],
+              "metadata": {
+                "description": "Optional. Specifies the eviction policy for the low priority virtual machine."
+              }
+            },
+            "maxPriceForLowPriorityVm": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Specifies the maximum price you are willing to pay for a low priority VM/VMSS. This price is in US Dollars."
+              }
+            },
+            "dedicatedHostId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Specifies resource ID about the dedicated host that the virtual machine resides in."
+              }
+            },
+            "licenseType": {
+              "type": "string",
+              "defaultValue": "",
+              "allowedValues": [
+                "RHEL_BYOS",
+                "SLES_BYOS",
+                "Windows_Client",
+                "Windows_Server",
+                ""
+              ],
+              "metadata": {
+                "description": "Optional. Specifies that the image or disk that is being used was licensed on-premises."
+              }
+            },
+            "publicKeys": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/publicKeyType"
+              },
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. The list of SSH public keys used to authenticate with linux based VMs."
+              }
+            },
+            "managedIdentities": {
+              "$ref": "#/definitions/managedIdentityAllType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The managed identity definition for this resource. The system-assigned managed identity will automatically be enabled if extensionAadJoinConfig.enabled = \"True\"."
+              }
+            },
+            "bootDiagnostics": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Whether boot diagnostics should be enabled on the Virtual Machine. Boot diagnostics will be enabled with a managed storage account if no bootDiagnosticsStorageAccountName value is provided. If bootDiagnostics and bootDiagnosticsStorageAccountName values are not provided, boot diagnostics will be disabled."
+              }
+            },
+            "bootDiagnosticStorageAccountName": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Custom storage account used to store boot diagnostic information. Boot diagnostics will be enabled with a custom storage account if a value is provided."
+              }
+            },
+            "bootDiagnosticStorageAccountUri": {
+              "type": "string",
+              "defaultValue": "[format('.blob.{0}/', environment().suffixes.storage)]",
+              "metadata": {
+                "description": "Optional. Storage account boot diagnostic base URI."
+              }
+            },
+            "proximityPlacementGroupResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Resource ID of a proximity placement group."
+              }
+            },
+            "virtualMachineScaleSetResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Resource ID of a virtual machine scale set, where the VM should be added."
+              }
+            },
+            "availabilitySetResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Resource ID of an availability set. Cannot be used in combination with availability zone nor scale set."
+              }
+            },
+            "galleryApplications": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. Specifies the gallery applications that should be made available to the VM/VMSS."
+              }
+            },
+            "zone": {
+              "type": "int",
+              "allowedValues": [
+                0,
+                1,
+                2,
+                3
+              ],
+              "metadata": {
+                "description": "Required. If set to 1, 2 or 3, the availability zone for all VMs is hardcoded to that value. If zero, then availability zones is not used. Cannot be used in combination with availability set nor scale set."
+              }
+            },
+            "nicConfigurations": {
+              "type": "array",
+              "metadata": {
+                "description": "Required. Configures NICs and PIPs."
+              }
+            },
+            "backupVaultName": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Recovery service vault name to add VMs to backup."
+              }
+            },
+            "backupVaultResourceGroup": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().name]",
+              "metadata": {
+                "description": "Optional. Resource group of the backup recovery service vault. If not provided the current resource group name is considered by default."
+              }
+            },
+            "backupPolicyName": {
+              "type": "string",
+              "defaultValue": "DefaultPolicy",
+              "metadata": {
+                "description": "Optional. Backup policy the VMs should be using for backup. If not provided, it will use the DefaultPolicy from the backup recovery service vault."
+              }
+            },
+            "autoShutdownConfig": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. The configuration for auto-shutdown."
+              }
+            },
+            "maintenanceConfigurationResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. The resource Id of a maintenance configuration for this VM."
+              }
+            },
+            "allowExtensionOperations": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Specifies whether extension operations should be allowed on the virtual machine. This may only be set to False when no extensions are present on the virtual machine."
+              }
+            },
+            "extensionDomainJoinPassword": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Required if name is specified. Password of the user specified in user parameter."
+              }
+            },
+            "extensionDomainJoinConfig": {
+              "type": "secureObject",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. The configuration for the [Domain Join] extension. Must at least contain the [\"enabled\": true] property to be executed."
+              }
+            },
+            "extensionAadJoinConfig": {
+              "type": "object",
+              "defaultValue": {
+                "enabled": false
+              },
+              "metadata": {
+                "description": "Optional. The configuration for the [AAD Join] extension. Must at least contain the [\"enabled\": true] property to be executed. To enroll in Intune, add the setting mdmId: \"0000000a-0000-0000-c000-000000000000\"."
+              }
+            },
+            "extensionAntiMalwareConfig": {
+              "type": "object",
+              "defaultValue": "[if(equals(parameters('osType'), 'Windows'), createObject('enabled', true()), createObject('enabled', false()))]",
+              "metadata": {
+                "description": "Optional. The configuration for the [Anti Malware] extension. Must at least contain the [\"enabled\": true] property to be executed."
+              }
+            },
+            "extensionMonitoringAgentConfig": {
+              "type": "object",
+              "defaultValue": {
+                "enabled": false,
+                "dataCollectionRuleAssociations": []
+              },
+              "metadata": {
+                "description": "Optional. The configuration for the [Monitoring Agent] extension. Must at least contain the [\"enabled\": true] property to be executed."
+              }
+            },
+            "extensionDependencyAgentConfig": {
+              "type": "object",
+              "defaultValue": {
+                "enabled": false
+              },
+              "metadata": {
+                "description": "Optional. The configuration for the [Dependency Agent] extension. Must at least contain the [\"enabled\": true] property to be executed."
+              }
+            },
+            "extensionNetworkWatcherAgentConfig": {
+              "type": "object",
+              "defaultValue": {
+                "enabled": false
+              },
+              "metadata": {
+                "description": "Optional. The configuration for the [Network Watcher Agent] extension. Must at least contain the [\"enabled\": true] property to be executed."
+              }
+            },
+            "extensionAzureDiskEncryptionConfig": {
+              "type": "object",
+              "defaultValue": {
+                "enabled": false
+              },
+              "metadata": {
+                "description": "Optional. The configuration for the [Azure Disk Encryption] extension. Must at least contain the [\"enabled\": true] property to be executed. Restrictions: Cannot be enabled on disks that have encryption at host enabled. Managed disks encrypted using Azure Disk Encryption cannot be encrypted using customer-managed keys."
+              }
+            },
+            "extensionDSCConfig": {
+              "type": "object",
+              "defaultValue": {
+                "enabled": false
+              },
+              "metadata": {
+                "description": "Optional. The configuration for the [Desired State Configuration] extension. Must at least contain the [\"enabled\": true] property to be executed."
+              }
+            },
+            "extensionCustomScriptConfig": {
+              "type": "object",
+              "defaultValue": {
+                "enabled": false,
+                "fileData": []
+              },
+              "metadata": {
+                "description": "Optional. The configuration for the [Custom Script] extension. Must at least contain the [\"enabled\": true] property to be executed."
+              }
+            },
+            "extensionNvidiaGpuDriverWindows": {
+              "type": "object",
+              "defaultValue": {
+                "enabled": false
+              },
+              "metadata": {
+                "description": "Optional. The configuration for the [Nvidia Gpu Driver Windows] extension. Must at least contain the [\"enabled\": true] property to be executed."
+              }
+            },
+            "extensionHostPoolRegistration": {
+              "type": "object",
+              "defaultValue": {
+                "enabled": false
+              },
+              "metadata": {
+                "description": "Optional. The configuration for the [Host Pool Registration] extension. Must at least contain the [\"enabled\": true] property to be executed. Needs a managed identy."
+              }
+            },
+            "extensionGuestConfigurationExtension": {
+              "type": "object",
+              "defaultValue": {
+                "enabled": false
+              },
+              "metadata": {
+                "description": "Optional. The configuration for the [Guest Configuration] extension. Must at least contain the [\"enabled\": true] property to be executed. Needs a managed identy."
+              }
+            },
+            "guestConfiguration": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. The guest configuration for the virtual machine. Needs the Guest Configuration extension to be enabled."
+              }
+            },
+            "extensionCustomScriptProtectedSetting": {
+              "type": "secureObject",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. An object that contains the extension specific protected settings."
+              }
+            },
+            "extensionGuestConfigurationExtensionProtectedSettings": {
+              "type": "secureObject",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. An object that contains the extension specific protected settings."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all resources."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "roleAssignments": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/roleAssignmentType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "baseTime": {
+              "type": "string",
+              "defaultValue": "[utcNow('u')]",
+              "metadata": {
+                "description": "Generated. Do not provide a value! This date value is used to generate a registration token."
+              }
+            },
+            "sasTokenValidityLength": {
+              "type": "string",
+              "defaultValue": "PT8H",
+              "metadata": {
+                "description": "Optional. SAS token validity length to use to download files from storage accounts. Usage: 'PT8H' - valid for 8 hours; 'P5D' - valid for 5 days; 'P1Y' - valid for 1 year. When not provided, the SAS token will be valid for 8 hours."
+              }
+            },
+            "osType": {
+              "type": "string",
+              "allowedValues": [
+                "Windows",
+                "Linux"
+              ],
+              "metadata": {
+                "description": "Required. The chosen OS type."
+              }
+            },
+            "disablePasswordAuthentication": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Specifies whether password authentication should be disabled."
+              }
+            },
+            "provisionVMAgent": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Indicates whether virtual machine agent should be provisioned on the virtual machine. When this property is not specified in the request body, default behavior is to set it to true. This will ensure that VM Agent is installed on the VM so that extensions can be added to the VM later."
+              }
+            },
+            "enableAutomaticUpdates": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Indicates whether Automatic Updates is enabled for the Windows virtual machine. Default value is true. When patchMode is set to Manual, this parameter must be set to false. For virtual machine scale sets, this property can be updated and updates will take effect on OS reprovisioning."
+              }
+            },
+            "patchMode": {
+              "type": "string",
+              "defaultValue": "",
+              "allowedValues": [
+                "AutomaticByPlatform",
+                "AutomaticByOS",
+                "Manual",
+                "ImageDefault",
+                ""
+              ],
+              "metadata": {
+                "description": "Optional. VM guest patching orchestration mode. 'AutomaticByOS' & 'Manual' are for Windows only, 'ImageDefault' for Linux only. Refer to 'https://learn.microsoft.com/en-us/azure/virtual-machines/automatic-vm-guest-patching'."
+              }
+            },
+            "bypassPlatformSafetyChecksOnUserSchedule": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enables customer to schedule patching without accidental upgrades."
+              }
+            },
+            "rebootSetting": {
+              "type": "string",
+              "defaultValue": "IfRequired",
+              "allowedValues": [
+                "Always",
+                "IfRequired",
+                "Never",
+                "Unknown"
+              ],
+              "metadata": {
+                "description": "Optional. Specifies the reboot setting for all AutomaticByPlatform patch installation operations."
+              }
+            },
+            "patchAssessmentMode": {
+              "type": "string",
+              "defaultValue": "ImageDefault",
+              "allowedValues": [
+                "AutomaticByPlatform",
+                "ImageDefault"
+              ],
+              "metadata": {
+                "description": "Optional. VM guest patching assessment mode. Set it to 'AutomaticByPlatform' to enable automatically check for updates every 24 hours."
+              }
+            },
+            "enableHotpatching": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Enables customers to patch their Azure VMs without requiring a reboot. For enableHotpatching, the 'provisionVMAgent' must be set to true and 'patchMode' must be set to 'AutomaticByPlatform'."
+              }
+            },
+            "timeZone": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Specifies the time zone of the virtual machine. e.g. 'Pacific Standard Time'. Possible values can be `TimeZoneInfo.id` value from time zones returned by `TimeZoneInfo.GetSystemTimeZones`."
+              }
+            },
+            "additionalUnattendContent": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. Specifies additional XML formatted information that can be included in the Unattend.xml file, which is used by Windows Setup. Contents are defined by setting name, component name, and the pass in which the content is applied."
+              }
+            },
+            "winRM": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. Specifies the Windows Remote Management listeners. This enables remote Windows PowerShell. - WinRMConfiguration object."
+              }
+            },
+            "configurationProfile": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. The configuration profile of automanage. Either '/providers/Microsoft.Automanage/bestPractices/AzureBestPracticesProduction', 'providers/Microsoft.Automanage/bestPractices/AzureBestPracticesDevTest' or the resource Id of custom profile."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "publicKeysFormatted",
+                "count": "[length(parameters('publicKeys'))]",
+                "input": {
+                  "path": "[parameters('publicKeys')[copyIndex('publicKeysFormatted')].path]",
+                  "keyData": "[parameters('publicKeys')[copyIndex('publicKeysFormatted')].keyData]"
+                }
+              },
+              {
+                "name": "formattedRoleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+              }
+            ],
+            "enableReferencedModulesTelemetry": false,
+            "linuxConfiguration": {
+              "disablePasswordAuthentication": "[parameters('disablePasswordAuthentication')]",
+              "ssh": {
+                "publicKeys": "[variables('publicKeysFormatted')]"
+              },
+              "provisionVMAgent": "[parameters('provisionVMAgent')]",
+              "patchSettings": "[if(and(parameters('provisionVMAgent'), or(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), equals(toLower(parameters('patchMode')), toLower('ImageDefault')))), createObject('patchMode', parameters('patchMode'), 'assessmentMode', parameters('patchAssessmentMode'), 'automaticByPlatformSettings', if(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), createObject('bypassPlatformSafetyChecksOnUserSchedule', parameters('bypassPlatformSafetyChecksOnUserSchedule'), 'rebootSetting', parameters('rebootSetting')), null())), null())]"
+            },
+            "windowsConfiguration": {
+              "provisionVMAgent": "[parameters('provisionVMAgent')]",
+              "enableAutomaticUpdates": "[parameters('enableAutomaticUpdates')]",
+              "patchSettings": "[if(and(parameters('provisionVMAgent'), or(or(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), equals(toLower(parameters('patchMode')), toLower('AutomaticByOS'))), equals(toLower(parameters('patchMode')), toLower('Manual')))), createObject('patchMode', parameters('patchMode'), 'assessmentMode', parameters('patchAssessmentMode'), 'enableHotpatching', if(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), parameters('enableHotpatching'), false()), 'automaticByPlatformSettings', if(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), createObject('bypassPlatformSafetyChecksOnUserSchedule', parameters('bypassPlatformSafetyChecksOnUserSchedule'), 'rebootSetting', parameters('rebootSetting')), null())), null())]",
+              "timeZone": "[if(empty(parameters('timeZone')), null(), parameters('timeZone'))]",
+              "additionalUnattendContent": "[if(empty(parameters('additionalUnattendContent')), null(), parameters('additionalUnattendContent'))]",
+              "winRM": "[if(not(empty(parameters('winRM'))), createObject('listeners', parameters('winRM')), null())]"
+            },
+            "accountSasProperties": {
+              "signedServices": "b",
+              "signedPermission": "r",
+              "signedExpiry": "[dateTimeAdd(parameters('baseTime'), parameters('sasTokenValidityLength'))]",
+              "signedResourceTypes": "o",
+              "signedProtocol": "https"
+            },
+            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(if(parameters('extensionAadJoinConfig').enabled, true(), coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false())), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+            "builtInRoleNames": {
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Data Operator for Managed Disks": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '959f8984-c045-4866-89c7-12bf9737be2e')]",
+              "Desktop Virtualization Power On Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '489581de-a3bd-480d-9518-53dea7416b33')]",
+              "Desktop Virtualization Power On Off Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '40c5ff49-9181-41f8-ae61-143b0e78555e')]",
+              "Desktop Virtualization Virtual Machine Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a959dbd1-f747-45e3-8ba6-dd80f235f97c')]",
+              "DevTest Labs User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76283e04-6283-4c54-8f91-bcf1374a3c64')]",
+              "Disk Backup Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3e5e47e6-65f7-47ef-90b5-e5dd4d455f24')]",
+              "Disk Pool Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '60fc6e62-5479-42d4-8bf4-67625fcc2840')]",
+              "Disk Restore Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b50d9833-a0cb-478e-945f-707fcc997c13')]",
+              "Disk Snapshot Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7efff54f-a5b4-42b5-a1c5-5411624893ce')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+              "Virtual Machine Administrator Login": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '1c0163c0-47e6-4577-8991-ea5c82e286e4')]",
+              "Virtual Machine Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9980e02c-c2be-4d73-94e8-173b1dc7cf3c')]",
+              "Virtual Machine User Login": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fb879df8-f326-4884-b1cf-06f3ad86be52')]",
+              "VM Scanner Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'd24ecba3-c1f4-40fa-a7bb-4588a071e8fd')]"
+            }
+          },
+          "resources": {
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.compute-virtualmachine.{0}.{1}', replace('0.13.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "managedDataDisks": {
+              "copy": {
+                "name": "managedDataDisks",
+                "count": "[length(coalesce(parameters('dataDisks'), createArray()))]"
+              },
+              "type": "Microsoft.Compute/disks",
+              "apiVersion": "2024-03-02",
+              "name": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()], 'name'), format('{0}-disk-data-{1}', parameters('name'), padLeft(add(copyIndex(), 1), 2, '0')))]",
+              "location": "[parameters('location')]",
+              "sku": {
+                "name": "[coalesce(parameters('dataDisks'), createArray())[copyIndex()].managedDisk.storageAccountType]"
+              },
+              "properties": {
+                "diskSizeGB": "[coalesce(parameters('dataDisks'), createArray())[copyIndex()].diskSizeGB]",
+                "creationData": {
+                  "createOption": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()], 'createoption'), 'Empty')]"
+                },
+                "diskIOPSReadWrite": "[tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()], 'diskIOPSReadWrite')]",
+                "diskMBpsReadWrite": "[tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()], 'diskMBpsReadWrite')]"
+              },
+              "zones": "[if(and(not(equals(parameters('zone'), 0)), not(contains(coalesce(parameters('dataDisks'), createArray())[copyIndex()].managedDisk.storageAccountType, 'ZRS'))), array(string(parameters('zone'))), null())]"
+            },
+            "vm": {
+              "type": "Microsoft.Compute/virtualMachines",
+              "apiVersion": "2024-07-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "identity": "[variables('identity')]",
+              "tags": "[parameters('tags')]",
+              "zones": "[if(not(equals(parameters('zone'), 0)), array(string(parameters('zone'))), null())]",
+              "plan": "[if(not(empty(parameters('plan'))), parameters('plan'), null())]",
+              "properties": {
+                "hardwareProfile": {
+                  "vmSize": "[parameters('vmSize')]"
+                },
+                "securityProfile": {
+                  "encryptionAtHost": "[if(parameters('encryptionAtHost'), parameters('encryptionAtHost'), null())]",
+                  "securityType": "[parameters('securityType')]",
+                  "uefiSettings": "[if(equals(parameters('securityType'), 'TrustedLaunch'), createObject('secureBootEnabled', parameters('secureBootEnabled'), 'vTpmEnabled', parameters('vTpmEnabled')), null())]"
+                },
+                "storageProfile": {
+                  "copy": [
+                    {
+                      "name": "dataDisks",
+                      "count": "[length(coalesce(parameters('dataDisks'), createArray()))]",
+                      "input": {
+                        "lun": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'lun'), copyIndex('dataDisks'))]",
+                        "name": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'name'), format('{0}-disk-data-{1}', parameters('name'), padLeft(add(copyIndex('dataDisks'), 1), 2, '0')))]",
+                        "diskSizeGB": "[coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].diskSizeGB]",
+                        "createOption": "[if(not(equals(resourceId('Microsoft.Compute/disks', coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'name'), format('{0}-disk-data-{1}', parameters('name'), padLeft(add(copyIndex('dataDisks'), 1), 2, '0')))), null())), 'Attach', coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'createoption'), 'Empty'))]",
+                        "deleteOption": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'deleteOption'), 'Delete')]",
+                        "caching": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'caching'), 'ReadOnly')]",
+                        "managedDisk": {
+                          "storageAccountType": "[coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk.storageAccountType]",
+                          "id": "[resourceId('Microsoft.Compute/disks', coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'name'), format('{0}-disk-data-{1}', parameters('name'), padLeft(add(copyIndex('dataDisks'), 1), 2, '0'))))]",
+                          "diskEncryptionSet": {
+                            "id": "[tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'diskEncryptionSetResourceId')]"
+                          }
+                        }
+                      }
+                    }
+                  ],
+                  "imageReference": "[parameters('imageReference')]",
+                  "osDisk": {
+                    "name": "[coalesce(tryGet(parameters('osDisk'), 'name'), format('{0}-disk-os-01', parameters('name')))]",
+                    "createOption": "[coalesce(tryGet(parameters('osDisk'), 'createOption'), 'FromImage')]",
+                    "deleteOption": "[coalesce(tryGet(parameters('osDisk'), 'deleteOption'), 'Delete')]",
+                    "diffDiskSettings": "[if(empty(coalesce(tryGet(parameters('osDisk'), 'diffDiskSettings'), createObject())), null(), createObject('option', 'Local', 'placement', parameters('osDisk').diffDiskSettings.placement))]",
+                    "diskSizeGB": "[parameters('osDisk').diskSizeGB]",
+                    "caching": "[coalesce(tryGet(parameters('osDisk'), 'caching'), 'ReadOnly')]",
+                    "managedDisk": {
+                      "storageAccountType": "[parameters('osDisk').managedDisk.storageAccountType]",
+                      "diskEncryptionSet": {
+                        "id": "[tryGet(parameters('osDisk').managedDisk, 'diskEncryptionSetResourceId')]"
+                      }
+                    }
+                  }
+                },
+                "additionalCapabilities": {
+                  "ultraSSDEnabled": "[parameters('ultraSSDEnabled')]"
+                },
+                "osProfile": {
+                  "computerName": "[parameters('computerName')]",
+                  "adminUsername": "[parameters('adminUsername')]",
+                  "adminPassword": "[parameters('adminPassword')]",
+                  "customData": "[if(not(empty(parameters('customData'))), base64(parameters('customData')), null())]",
+                  "windowsConfiguration": "[if(equals(parameters('osType'), 'Windows'), variables('windowsConfiguration'), null())]",
+                  "linuxConfiguration": "[if(equals(parameters('osType'), 'Linux'), variables('linuxConfiguration'), null())]",
+                  "secrets": "[parameters('certificatesToBeInstalled')]",
+                  "allowExtensionOperations": "[parameters('allowExtensionOperations')]"
+                },
+                "networkProfile": {
+                  "copy": [
+                    {
+                      "name": "networkInterfaces",
+                      "count": "[length(parameters('nicConfigurations'))]",
+                      "input": {
+                        "properties": {
+                          "deleteOption": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex('networkInterfaces')], 'deleteOption'), 'Delete')]",
+                          "primary": "[if(equals(copyIndex('networkInterfaces'), 0), true(), false())]"
+                        },
+                        "id": "[resourceId('Microsoft.Network/networkInterfaces', coalesce(tryGet(parameters('nicConfigurations')[copyIndex('networkInterfaces')], 'name'), format('{0}{1}', parameters('name'), tryGet(parameters('nicConfigurations')[copyIndex('networkInterfaces')], 'nicSuffix'))))]"
+                      }
+                    }
+                  ]
+                },
+                "diagnosticsProfile": {
+                  "bootDiagnostics": {
+                    "enabled": "[if(not(empty(parameters('bootDiagnosticStorageAccountName'))), true(), parameters('bootDiagnostics'))]",
+                    "storageUri": "[if(not(empty(parameters('bootDiagnosticStorageAccountName'))), format('https://{0}{1}', parameters('bootDiagnosticStorageAccountName'), parameters('bootDiagnosticStorageAccountUri')), null())]"
+                  }
+                },
+                "applicationProfile": "[if(not(empty(parameters('galleryApplications'))), createObject('galleryApplications', parameters('galleryApplications')), null())]",
+                "availabilitySet": "[if(not(empty(parameters('availabilitySetResourceId'))), createObject('id', parameters('availabilitySetResourceId')), null())]",
+                "proximityPlacementGroup": "[if(not(empty(parameters('proximityPlacementGroupResourceId'))), createObject('id', parameters('proximityPlacementGroupResourceId')), null())]",
+                "virtualMachineScaleSet": "[if(not(empty(parameters('virtualMachineScaleSetResourceId'))), createObject('id', parameters('virtualMachineScaleSetResourceId')), null())]",
+                "priority": "[parameters('priority')]",
+                "evictionPolicy": "[if(not(equals('Regular', parameters('priority'))), parameters('evictionPolicy'), null())]",
+                "billingProfile": "[if(and(not(empty(parameters('priority'))), not(empty(parameters('maxPriceForLowPriorityVm')))), createObject('maxPrice', json(parameters('maxPriceForLowPriorityVm'))), null())]",
+                "host": "[if(not(empty(parameters('dedicatedHostId'))), createObject('id', parameters('dedicatedHostId')), null())]",
+                "licenseType": "[if(not(empty(parameters('licenseType'))), parameters('licenseType'), null())]",
+                "userData": "[if(not(empty(parameters('userData'))), base64(parameters('userData')), null())]"
+              },
+              "dependsOn": [
+                "managedDataDisks",
+                "vm_nic"
+              ]
+            },
+            "vm_configurationAssignment": {
+              "condition": "[not(empty(parameters('maintenanceConfigurationResourceId')))]",
+              "type": "Microsoft.Maintenance/configurationAssignments",
+              "apiVersion": "2023-04-01",
+              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
+              "name": "[format('{0}assignment', parameters('name'))]",
+              "location": "[parameters('location')]",
+              "properties": {
+                "maintenanceConfigurationId": "[parameters('maintenanceConfigurationResourceId')]",
+                "resourceId": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
+              },
+              "dependsOn": [
+                "vm"
+              ]
+            },
+            "vm_configurationProfileAssignment": {
+              "condition": "[not(empty(parameters('configurationProfile')))]",
+              "type": "Microsoft.Automanage/configurationProfileAssignments",
+              "apiVersion": "2022-05-04",
+              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
+              "name": "default",
+              "properties": {
+                "configurationProfile": "[parameters('configurationProfile')]"
+              },
+              "dependsOn": [
+                "vm"
+              ]
+            },
+            "vm_autoShutdownConfiguration": {
+              "condition": "[not(empty(parameters('autoShutdownConfig')))]",
+              "type": "Microsoft.DevTestLab/schedules",
+              "apiVersion": "2018-09-15",
+              "name": "[format('shutdown-computevm-{0}', parameters('name'))]",
+              "location": "[parameters('location')]",
+              "properties": {
+                "status": "[coalesce(tryGet(parameters('autoShutdownConfig'), 'status'), 'Disabled')]",
+                "targetResourceId": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]",
+                "taskType": "ComputeVmShutdownTask",
+                "dailyRecurrence": {
+                  "time": "[coalesce(tryGet(parameters('autoShutdownConfig'), 'dailyRecurrenceTime'), '19:00')]"
+                },
+                "timeZoneId": "[coalesce(tryGet(parameters('autoShutdownConfig'), 'timeZone'), 'UTC')]",
+                "notificationSettings": "[if(contains(parameters('autoShutdownConfig'), 'notificationStatus'), createObject('status', coalesce(tryGet(parameters('autoShutdownConfig'), 'notificationStatus'), 'Disabled'), 'emailRecipient', coalesce(tryGet(parameters('autoShutdownConfig'), 'notificationEmail'), ''), 'notificationLocale', coalesce(tryGet(parameters('autoShutdownConfig'), 'notificationLocale'), 'en'), 'webhookUrl', coalesce(tryGet(parameters('autoShutdownConfig'), 'notificationWebhookUrl'), ''), 'timeInMinutes', coalesce(tryGet(parameters('autoShutdownConfig'), 'notificationTimeInMinutes'), 30)), null())]"
+              },
+              "dependsOn": [
+                "vm"
+              ]
+            },
+            "vm_dataCollectionRuleAssociations": {
+              "copy": {
+                "name": "vm_dataCollectionRuleAssociations",
+                "count": "[length(parameters('extensionMonitoringAgentConfig').dataCollectionRuleAssociations)]"
+              },
+              "condition": "[parameters('extensionMonitoringAgentConfig').enabled]",
+              "type": "Microsoft.Insights/dataCollectionRuleAssociations",
+              "apiVersion": "2023-03-11",
+              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
+              "name": "[parameters('extensionMonitoringAgentConfig').dataCollectionRuleAssociations[copyIndex()].name]",
+              "properties": {
+                "dataCollectionRuleId": "[parameters('extensionMonitoringAgentConfig').dataCollectionRuleAssociations[copyIndex()].dataCollectionRuleResourceId]"
+              },
+              "dependsOn": [
+                "vm",
+                "vm_azureMonitorAgentExtension"
+              ]
+            },
+            "AzureWindowsBaseline": {
+              "condition": "[not(empty(parameters('guestConfiguration')))]",
+              "type": "Microsoft.GuestConfiguration/guestConfigurationAssignments",
+              "apiVersion": "2020-06-25",
+              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
+              "name": "AzureWindowsBaseline",
+              "location": "[parameters('location')]",
+              "properties": {
+                "guestConfiguration": "[parameters('guestConfiguration')]"
+              },
+              "dependsOn": [
+                "vm",
+                "vm_azureGuestConfigurationExtension"
+              ]
+            },
+            "vm_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "vm"
+              ]
+            },
+            "vm_roleAssignments": {
+              "copy": {
+                "name": "vm_roleAssignments",
+                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Compute/virtualMachines', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+              "properties": {
+                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "vm"
+              ]
+            },
+            "vm_nic": {
+              "copy": {
+                "name": "vm_nic",
+                "count": "[length(parameters('nicConfigurations'))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-Nic-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "networkInterfaceName": {
+                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'name'), format('{0}{1}', parameters('name'), tryGet(parameters('nicConfigurations')[copyIndex()], 'nicSuffix')))]"
+                  },
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "enableIPForwarding": {
+                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'enableIPForwarding'), false())]"
+                  },
+                  "enableAcceleratedNetworking": {
+                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'enableAcceleratedNetworking'), true())]"
+                  },
+                  "dnsServers": "[if(contains(parameters('nicConfigurations')[copyIndex()], 'dnsServers'), if(not(empty(parameters('nicConfigurations')[copyIndex()].dnsServers)), createObject('value', parameters('nicConfigurations')[copyIndex()].dnsServers), createObject('value', createArray())), createObject('value', createArray()))]",
+                  "networkSecurityGroupResourceId": {
+                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'networkSecurityGroupResourceId'), '')]"
+                  },
+                  "ipConfigurations": {
+                    "value": "[parameters('nicConfigurations')[copyIndex()].ipConfigurations]"
+                  },
+                  "lock": {
+                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'lock'), parameters('lock'))]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'tags'), parameters('tags'))]"
+                  },
+                  "diagnosticSettings": {
+                    "value": "[tryGet(parameters('nicConfigurations')[copyIndex()], 'diagnosticSettings')]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(parameters('nicConfigurations')[copyIndex()], 'roleAssignments')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "8556043111080362230"
+                    }
+                  },
+                  "definitions": {
+                    "diagnosticSettingFullType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "networkInterfaceName": {
+                      "type": "string"
+                    },
+                    "virtualMachineName": {
+                      "type": "string"
+                    },
+                    "ipConfigurations": {
+                      "type": "array"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "enableIPForwarding": {
+                      "type": "bool",
+                      "defaultValue": false
+                    },
+                    "enableAcceleratedNetworking": {
+                      "type": "bool",
+                      "defaultValue": false
+                    },
+                    "dnsServers": {
+                      "type": "array",
+                      "defaultValue": []
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Enable telemetry via a Globally Unique Identifier (GUID)."
+                      }
+                    },
+                    "networkSecurityGroupResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. The network security group (NSG) to attach to the network interface."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingFullType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "networkInterface_publicIPAddresses": {
+                      "copy": {
+                        "name": "networkInterface_publicIPAddresses",
+                        "count": "[length(parameters('ipConfigurations'))]"
+                      },
+                      "condition": "[and(contains(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), not(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'publicIPAddressResourceId')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-publicIP-{1}', deployment().name, copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'name'), format('{0}{1}', parameters('virtualMachineName'), tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'publicIpNameSuffix')))]"
+                          },
+                          "diagnosticSettings": {
+                            "value": "[tryGet(parameters('ipConfigurations')[copyIndex()], 'diagnosticSettings')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "lock": {
+                            "value": "[parameters('lock')]"
+                          },
+                          "idleTimeoutInMinutes": {
+                            "value": "[tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'idleTimeoutInMinutes')]"
+                          },
+                          "ddosSettings": {
+                            "value": "[tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'ddosSettings')]"
+                          },
+                          "dnsSettings": {
+                            "value": "[tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'dnsSettings')]"
+                          },
+                          "publicIPAddressVersion": {
+                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'publicIPAddressVersion'), 'IPv4')]"
+                          },
+                          "publicIPAllocationMethod": {
+                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'publicIPAllocationMethod'), 'Static')]"
+                          },
+                          "publicIpPrefixResourceId": {
+                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'publicIPPrefixResourceId'), '')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'roleAssignments'), createArray())]"
+                          },
+                          "skuName": {
+                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'skuName'), 'Standard')]"
+                          },
+                          "skuTier": {
+                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'skuTier'), 'Regional')]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "zones": {
+                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'zones'), createArray(1, 2, 3))]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()], 'enableTelemetry'), parameters('enableTelemetry'))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.29.47.4906",
+                              "templateHash": "16693645977675862540"
+                            },
+                            "name": "Public IP Addresses",
+                            "description": "This module deploys a Public IP Address.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                    }
+                                  },
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "dnsSettingsType": {
+                              "type": "object",
+                              "properties": {
+                                "domainNameLabel": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The domain name label. The concatenation of the domain name label and the regionalized DNS zone make up the fully qualified domain name associated with the public IP address. If a domain name label is specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system."
+                                  }
+                                },
+                                "domainNameLabelScope": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "",
+                                    "NoReuse",
+                                    "ResourceGroupReuse",
+                                    "SubscriptionReuse",
+                                    "TenantReuse"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The domain name label scope. If a domain name label and a domain name label scope are specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system with a hashed value includes in FQDN."
+                                  }
+                                },
+                                "fqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Fully Qualified Domain Name of the A DNS record associated with the public IP. This is the concatenation of the domainNameLabel and the regionalized DNS zone."
+                                  }
+                                },
+                                "reverseFqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The reverse FQDN. A user-visible, fully qualified domain name that resolves to this public IP address. If the reverseFqdn is specified, then a PTR DNS record is created pointing from the IP address in the in-addr.arpa domain to the reverse FQDN."
+                                  }
+                                }
+                              }
+                            },
+                            "ddosSettingsType": {
+                              "type": "object",
+                              "properties": {
+                                "ddosProtectionPlan": {
+                                  "type": "object",
+                                  "properties": {
+                                    "id": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The resource ID of the DDOS protection plan associated with the public IP address."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The DDoS protection plan associated with the public IP address."
+                                  }
+                                },
+                                "protectionMode": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Enabled"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The DDoS protection policy customizations."
+                                  }
+                                }
+                              }
+                            },
+                            "diagnosticSettingType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of diagnostic setting."
+                                    }
+                                  },
+                                  "logCategoriesAndGroups": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "category": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                          }
+                                        },
+                                        "categoryGroup": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                          }
+                                        },
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                    }
+                                  },
+                                  "metricCategories": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "category": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                          }
+                                        },
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                    }
+                                  },
+                                  "logAnalyticsDestinationType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "AzureDiagnostics",
+                                      "Dedicated"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                    }
+                                  },
+                                  "workspaceResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "storageAccountResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "eventHubAuthorizationRuleResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                    }
+                                  },
+                                  "eventHubName": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "marketplacePartnerResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the Public IP Address."
+                              }
+                            },
+                            "publicIpPrefixResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Resource ID of the Public IP Prefix object. This is only needed if you want your Public IPs created in a PIP Prefix."
+                              }
+                            },
+                            "publicIPAllocationMethod": {
+                              "type": "string",
+                              "defaultValue": "Static",
+                              "allowedValues": [
+                                "Dynamic",
+                                "Static"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The public IP address allocation method."
+                              }
+                            },
+                            "zones": {
+                              "type": "array",
+                              "items": {
+                                "type": "int"
+                              },
+                              "defaultValue": [
+                                1,
+                                2,
+                                3
+                              ],
+                              "allowedValues": [
+                                1,
+                                2,
+                                3
+                              ],
+                              "metadata": {
+                                "description": "Optional. A list of availability zones denoting the IP allocated for the resource needs to come from."
+                              }
+                            },
+                            "publicIPAddressVersion": {
+                              "type": "string",
+                              "defaultValue": "IPv4",
+                              "allowedValues": [
+                                "IPv4",
+                                "IPv6"
+                              ],
+                              "metadata": {
+                                "description": "Optional. IP address version."
+                              }
+                            },
+                            "dnsSettings": {
+                              "$ref": "#/definitions/dnsSettingsType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The DNS settings of the public IP address."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "skuName": {
+                              "type": "string",
+                              "defaultValue": "Standard",
+                              "allowedValues": [
+                                "Basic",
+                                "Standard"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Name of a public IP address SKU."
+                              }
+                            },
+                            "skuTier": {
+                              "type": "string",
+                              "defaultValue": "Regional",
+                              "allowedValues": [
+                                "Global",
+                                "Regional"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Tier of a public IP address SKU."
+                              }
+                            },
+                            "ddosSettings": {
+                              "$ref": "#/definitions/ddosSettingsType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The DDoS protection plan configuration associated with the public IP address."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "idleTimeoutInMinutes": {
+                              "type": "int",
+                              "defaultValue": 4,
+                              "metadata": {
+                                "description": "Optional. The idle timeout of the public IP address."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the resource."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "$ref": "#/definitions/diagnosticSettingType",
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.network-publicipaddress.{0}.{1}', replace('0.6.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "publicIpAddress": {
+                              "type": "Microsoft.Network/publicIPAddresses",
+                              "apiVersion": "2023-09-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "sku": {
+                                "name": "[parameters('skuName')]",
+                                "tier": "[parameters('skuTier')]"
+                              },
+                              "zones": "[map(parameters('zones'), lambda('zone', string(lambdaVariables('zone'))))]",
+                              "properties": {
+                                "ddosSettings": "[parameters('ddosSettings')]",
+                                "dnsSettings": "[parameters('dnsSettings')]",
+                                "publicIPAddressVersion": "[parameters('publicIPAddressVersion')]",
+                                "publicIPAllocationMethod": "[parameters('publicIPAllocationMethod')]",
+                                "publicIPPrefix": "[if(not(empty(parameters('publicIpPrefixResourceId'))), createObject('id', parameters('publicIpPrefixResourceId')), null())]",
+                                "idleTimeoutInMinutes": "[parameters('idleTimeoutInMinutes')]",
+                                "ipTags": null
+                              }
+                            },
+                            "publicIpAddress_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                              },
+                              "dependsOn": [
+                                "publicIpAddress"
+                              ]
+                            },
+                            "publicIpAddress_roleAssignments": {
+                              "copy": {
+                                "name": "publicIpAddress_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/publicIPAddresses', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "publicIpAddress"
+                              ]
+                            },
+                            "publicIpAddress_diagnosticSettings": {
+                              "copy": {
+                                "name": "publicIpAddress_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "publicIpAddress"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the public IP address was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the public IP address."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the public IP address."
+                              },
+                              "value": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('name'))]"
+                            },
+                            "ipAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The public IP address of the public IP address resource."
+                              },
+                              "value": "[coalesce(tryGet(reference('publicIpAddress'), 'ipAddress'), '')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('publicIpAddress', '2023-09-01', 'full').location]"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "networkInterface": {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-NetworkInterface', deployment().name)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('networkInterfaceName')]"
+                          },
+                          "ipConfigurations": {
+                            "copy": [
+                              {
+                                "name": "value",
+                                "count": "[length(parameters('ipConfigurations'))]",
+                                "input": "[createObject('name', if(not(empty(parameters('ipConfigurations')[copyIndex('value')].name)), parameters('ipConfigurations')[copyIndex('value')].name, null()), 'primary', equals(copyIndex('value'), 0), 'privateIPAllocationMethod', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'privateIPAllocationMethod'), if(not(empty(parameters('ipConfigurations')[copyIndex('value')].privateIPAllocationMethod)), parameters('ipConfigurations')[copyIndex('value')].privateIPAllocationMethod, null()), null()), 'privateIPAddress', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'privateIPAddress'), if(not(empty(parameters('ipConfigurations')[copyIndex('value')].privateIPAddress)), parameters('ipConfigurations')[copyIndex('value')].privateIPAddress, null()), null()), 'publicIPAddressResourceId', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'pipConfiguration'), if(not(contains(parameters('ipConfigurations')[copyIndex('value')].pipConfiguration, 'publicIPAddressResourceId')), resourceId('Microsoft.Network/publicIPAddresses', coalesce(tryGet(parameters('ipConfigurations')[copyIndex('value')].pipConfiguration, 'name'), format('{0}{1}', parameters('virtualMachineName'), tryGet(parameters('ipConfigurations')[copyIndex('value')].pipConfiguration, 'publicIpNameSuffix')))), parameters('ipConfigurations')[copyIndex('value')].pipConfiguration.publicIPAddressResourceId), null()), 'subnetResourceId', parameters('ipConfigurations')[copyIndex('value')].subnetResourceId, 'loadBalancerBackendAddressPools', coalesce(tryGet(parameters('ipConfigurations')[copyIndex('value')], 'loadBalancerBackendAddressPools'), null()), 'applicationSecurityGroups', coalesce(tryGet(parameters('ipConfigurations')[copyIndex('value')], 'applicationSecurityGroups'), null()), 'applicationGatewayBackendAddressPools', coalesce(tryGet(parameters('ipConfigurations')[copyIndex('value')], 'applicationGatewayBackendAddressPools'), null()), 'gatewayLoadBalancer', coalesce(tryGet(parameters('ipConfigurations')[copyIndex('value')], 'gatewayLoadBalancer'), null()), 'loadBalancerInboundNatRules', coalesce(tryGet(parameters('ipConfigurations')[copyIndex('value')], 'loadBalancerInboundNatRules'), null()), 'privateIPAddressVersion', coalesce(tryGet(parameters('ipConfigurations')[copyIndex('value')], 'privateIPAddressVersion'), null()), 'virtualNetworkTaps', coalesce(tryGet(parameters('ipConfigurations')[copyIndex('value')], 'virtualNetworkTaps'), null()))]"
+                              }
+                            ]
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "diagnosticSettings": {
+                            "value": "[parameters('diagnosticSettings')]"
+                          },
+                          "dnsServers": "[if(not(empty(parameters('dnsServers'))), createObject('value', parameters('dnsServers')), createObject('value', createArray()))]",
+                          "enableAcceleratedNetworking": {
+                            "value": "[parameters('enableAcceleratedNetworking')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "enableIPForwarding": {
+                            "value": "[parameters('enableIPForwarding')]"
+                          },
+                          "lock": {
+                            "value": "[parameters('lock')]"
+                          },
+                          "networkSecurityGroupResourceId": "[if(not(empty(parameters('networkSecurityGroupResourceId'))), createObject('value', parameters('networkSecurityGroupResourceId')), createObject('value', ''))]",
+                          "roleAssignments": "[if(not(empty(parameters('roleAssignments'))), createObject('value', parameters('roleAssignments')), createObject('value', createArray()))]"
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.29.47.4906",
+                              "templateHash": "9226998037927576702"
+                            },
+                            "name": "Network Interface",
+                            "description": "This module deploys a Network Interface.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "diagnosticSettingType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of diagnostic setting."
+                                    }
+                                  },
+                                  "logCategoriesAndGroups": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "category": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                          }
+                                        },
+                                        "categoryGroup": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                          }
+                                        },
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                    }
+                                  },
+                                  "metricCategories": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "category": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                          }
+                                        },
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                    }
+                                  },
+                                  "logAnalyticsDestinationType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "AzureDiagnostics",
+                                      "Dedicated"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                    }
+                                  },
+                                  "workspaceResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "storageAccountResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "eventHubAuthorizationRuleResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                    }
+                                  },
+                                  "eventHubName": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "marketplacePartnerResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                    }
+                                  },
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the network interface."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Resource tags."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "enableIPForwarding": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Indicates whether IP forwarding is enabled on this network interface."
+                              }
+                            },
+                            "enableAcceleratedNetworking": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. If the network interface is accelerated networking enabled."
+                              }
+                            },
+                            "dnsServers": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. List of DNS servers IP addresses. Use 'AzureProvidedDNS' to switch to azure provided DNS resolution. 'AzureProvidedDNS' value cannot be combined with other IPs, it must be the only value in dnsServers collection."
+                              }
+                            },
+                            "networkSecurityGroupResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The network security group (NSG) to attach to the network interface."
+                              }
+                            },
+                            "auxiliaryMode": {
+                              "type": "string",
+                              "defaultValue": "None",
+                              "allowedValues": [
+                                "Floating",
+                                "MaxConnections",
+                                "None"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Auxiliary mode of Network Interface resource. Not all regions are enabled for Auxiliary Mode Nic."
+                              }
+                            },
+                            "auxiliarySku": {
+                              "type": "string",
+                              "defaultValue": "None",
+                              "allowedValues": [
+                                "A1",
+                                "A2",
+                                "A4",
+                                "A8",
+                                "None"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Auxiliary sku of Network Interface resource. Not all regions are enabled for Auxiliary Mode Nic."
+                              }
+                            },
+                            "disableTcpStateTracking": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Indicates whether to disable tcp state tracking. Subscription must be registered for the Microsoft.Network/AllowDisableTcpStateTracking feature before this property can be set to true."
+                              }
+                            },
+                            "ipConfigurations": {
+                              "type": "array",
+                              "metadata": {
+                                "description": "Required. A list of IPConfigurations of the network interface."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "$ref": "#/definitions/diagnosticSettingType",
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.network-networkinterface.{0}.{1}', replace('0.4.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "networkInterface": {
+                              "type": "Microsoft.Network/networkInterfaces",
+                              "apiVersion": "2023-04-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "ipConfigurations",
+                                    "count": "[length(parameters('ipConfigurations'))]",
+                                    "input": {
+                                      "name": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'name'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].name, format('ipconfig0{0}', add(copyIndex('ipConfigurations'), 1)))]",
+                                      "properties": {
+                                        "primary": "[if(equals(copyIndex('ipConfigurations'), 0), true(), false())]",
+                                        "privateIPAllocationMethod": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'privateIPAllocationMethod'), if(not(empty(parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAllocationMethod)), parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAllocationMethod, null()), null())]",
+                                        "privateIPAddress": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'privateIPAddress'), if(not(empty(parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAddress)), parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAddress, null()), null())]",
+                                        "publicIPAddress": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'publicIPAddressResourceId'), if(not(equals(parameters('ipConfigurations')[copyIndex('ipConfigurations')].publicIPAddressResourceId, null())), createObject('id', parameters('ipConfigurations')[copyIndex('ipConfigurations')].publicIPAddressResourceId), null()), null())]",
+                                        "subnet": {
+                                          "id": "[parameters('ipConfigurations')[copyIndex('ipConfigurations')].subnetResourceId]"
+                                        },
+                                        "loadBalancerBackendAddressPools": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'loadBalancerBackendAddressPools'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].loadBalancerBackendAddressPools, null())]",
+                                        "applicationSecurityGroups": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'applicationSecurityGroups'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].applicationSecurityGroups, null())]",
+                                        "applicationGatewayBackendAddressPools": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'applicationGatewayBackendAddressPools'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].applicationGatewayBackendAddressPools, null())]",
+                                        "gatewayLoadBalancer": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'gatewayLoadBalancer'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].gatewayLoadBalancer, null())]",
+                                        "loadBalancerInboundNatRules": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'loadBalancerInboundNatRules'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].loadBalancerInboundNatRules, null())]",
+                                        "privateIPAddressVersion": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'privateIPAddressVersion'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAddressVersion, null())]",
+                                        "virtualNetworkTaps": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'virtualNetworkTaps'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].virtualNetworkTaps, null())]"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "auxiliaryMode": "[parameters('auxiliaryMode')]",
+                                "auxiliarySku": "[parameters('auxiliarySku')]",
+                                "disableTcpStateTracking": "[parameters('disableTcpStateTracking')]",
+                                "dnsSettings": "[if(not(empty(parameters('dnsServers'))), createObject('dnsServers', parameters('dnsServers')), null())]",
+                                "enableAcceleratedNetworking": "[parameters('enableAcceleratedNetworking')]",
+                                "enableIPForwarding": "[parameters('enableIPForwarding')]",
+                                "networkSecurityGroup": "[if(not(empty(parameters('networkSecurityGroupResourceId'))), createObject('id', parameters('networkSecurityGroupResourceId')), null())]"
+                              }
+                            },
+                            "networkInterface_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Network/networkInterfaces/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                              },
+                              "dependsOn": [
+                                "networkInterface"
+                              ]
+                            },
+                            "networkInterface_diagnosticSettings": {
+                              "copy": {
+                                "name": "networkInterface_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[format('Microsoft.Network/networkInterfaces/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "networkInterface"
+                              ]
+                            },
+                            "networkInterface_roleAssignments": {
+                              "copy": {
+                                "name": "networkInterface_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/networkInterfaces/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/networkInterfaces', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "networkInterface"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed resource."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed resource."
+                              },
+                              "value": "[resourceId('Microsoft.Network/networkInterfaces', parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed resource."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('networkInterface', '2023-04-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "networkInterface_publicIPAddresses"
+                      ]
+                    }
+                  }
+                }
+              }
+            },
+            "vm_aadJoinExtension": {
+              "condition": "[parameters('extensionAadJoinConfig').enabled]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-AADLogin', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "AADLogin"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": {
+                    "value": "Microsoft.Azure.ActiveDirectory"
+                  },
+                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AADLoginForWindows'), createObject('value', 'AADSSHLoginforLinux'))]",
+                  "typeHandlerVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'typeHandlerVersion'), if(equals(parameters('osType'), 'Windows'), '2.0', '1.0'))]"
+                  },
+                  "autoUpgradeMinorVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'autoUpgradeMinorVersion'), true())]"
+                  },
+                  "enableAutomaticUpgrade": {
+                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'enableAutomaticUpgrade'), false())]"
+                  },
+                  "settings": {
+                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'settings'), createObject())]"
+                  },
+                  "supressFailures": {
+                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'supressFailures'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'tags'), parameters('tags'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "8482591295619883067"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension."
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm"
+              ]
+            },
+            "vm_domainJoinExtension": {
+              "condition": "[and(contains(parameters('extensionDomainJoinConfig'), 'enabled'), parameters('extensionDomainJoinConfig').enabled)]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-DomainJoin', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "DomainJoin"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": {
+                    "value": "Microsoft.Compute"
+                  },
+                  "type": {
+                    "value": "JsonADDomainExtension"
+                  },
+                  "typeHandlerVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'typeHandlerVersion'), '1.3')]"
+                  },
+                  "autoUpgradeMinorVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'autoUpgradeMinorVersion'), true())]"
+                  },
+                  "enableAutomaticUpgrade": {
+                    "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'enableAutomaticUpgrade'), false())]"
+                  },
+                  "settings": {
+                    "value": "[parameters('extensionDomainJoinConfig').settings]"
+                  },
+                  "supressFailures": {
+                    "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'supressFailures'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'tags'), parameters('tags'))]"
+                  },
+                  "protectedSettings": {
+                    "value": {
+                      "Password": "[parameters('extensionDomainJoinPassword')]"
+                    }
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "8482591295619883067"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension."
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_aadJoinExtension"
+              ]
+            },
+            "vm_microsoftAntiMalwareExtension": {
+              "condition": "[parameters('extensionAntiMalwareConfig').enabled]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-MicrosoftAntiMalware', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "MicrosoftAntiMalware"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": {
+                    "value": "Microsoft.Azure.Security"
+                  },
+                  "type": {
+                    "value": "IaaSAntimalware"
+                  },
+                  "typeHandlerVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'typeHandlerVersion'), '1.3')]"
+                  },
+                  "autoUpgradeMinorVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'autoUpgradeMinorVersion'), true())]"
+                  },
+                  "enableAutomaticUpgrade": {
+                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'enableAutomaticUpgrade'), false())]"
+                  },
+                  "settings": {
+                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'settings'), createObject('AntimalwareEnabled', 'true', 'Exclusions', createObject(), 'RealtimeProtectionEnabled', 'true', 'ScheduledScanSettings', createObject('day', '7', 'isEnabled', 'true', 'scanType', 'Quick', 'time', '120')))]"
+                  },
+                  "supressFailures": {
+                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'supressFailures'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'tags'), parameters('tags'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "8482591295619883067"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension."
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_domainJoinExtension"
+              ]
+            },
+            "vm_azureMonitorAgentExtension": {
+              "condition": "[parameters('extensionMonitoringAgentConfig').enabled]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-AzureMonitorAgent', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "AzureMonitorAgent"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": {
+                    "value": "Microsoft.Azure.Monitor"
+                  },
+                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AzureMonitorWindowsAgent'), createObject('value', 'AzureMonitorLinuxAgent'))]",
+                  "typeHandlerVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'typeHandlerVersion'), if(equals(parameters('osType'), 'Windows'), '1.22', '1.29'))]"
+                  },
+                  "autoUpgradeMinorVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'autoUpgradeMinorVersion'), true())]"
+                  },
+                  "enableAutomaticUpgrade": {
+                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'enableAutomaticUpgrade'), false())]"
+                  },
+                  "supressFailures": {
+                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'supressFailures'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'tags'), parameters('tags'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "8482591295619883067"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension."
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_microsoftAntiMalwareExtension"
+              ]
+            },
+            "vm_dependencyAgentExtension": {
+              "condition": "[parameters('extensionDependencyAgentConfig').enabled]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-DependencyAgent', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "DependencyAgent"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": {
+                    "value": "Microsoft.Azure.Monitoring.DependencyAgent"
+                  },
+                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'DependencyAgentWindows'), createObject('value', 'DependencyAgentLinux'))]",
+                  "typeHandlerVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'typeHandlerVersion'), '9.10')]"
+                  },
+                  "autoUpgradeMinorVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'autoUpgradeMinorVersion'), true())]"
+                  },
+                  "enableAutomaticUpgrade": {
+                    "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'enableAutomaticUpgrade'), true())]"
+                  },
+                  "settings": {
+                    "value": {
+                      "enableAMA": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'enableAMA'), true())]"
+                    }
+                  },
+                  "supressFailures": {
+                    "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'supressFailures'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'tags'), parameters('tags'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "8482591295619883067"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension."
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_azureMonitorAgentExtension"
+              ]
+            },
+            "vm_networkWatcherAgentExtension": {
+              "condition": "[parameters('extensionNetworkWatcherAgentConfig').enabled]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-NetworkWatcherAgent', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "NetworkWatcherAgent"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": {
+                    "value": "Microsoft.Azure.NetworkWatcher"
+                  },
+                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'NetworkWatcherAgentWindows'), createObject('value', 'NetworkWatcherAgentLinux'))]",
+                  "typeHandlerVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'typeHandlerVersion'), '1.4')]"
+                  },
+                  "autoUpgradeMinorVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'autoUpgradeMinorVersion'), true())]"
+                  },
+                  "enableAutomaticUpgrade": {
+                    "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'enableAutomaticUpgrade'), false())]"
+                  },
+                  "supressFailures": {
+                    "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'supressFailures'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'tags'), parameters('tags'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "8482591295619883067"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension."
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_dependencyAgentExtension"
+              ]
+            },
+            "vm_desiredStateConfigurationExtension": {
+              "condition": "[parameters('extensionDSCConfig').enabled]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-DesiredStateConfiguration', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "DesiredStateConfiguration"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": {
+                    "value": "Microsoft.Powershell"
+                  },
+                  "type": {
+                    "value": "DSC"
+                  },
+                  "typeHandlerVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'typeHandlerVersion'), '2.77')]"
+                  },
+                  "autoUpgradeMinorVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'autoUpgradeMinorVersion'), true())]"
+                  },
+                  "enableAutomaticUpgrade": {
+                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'enableAutomaticUpgrade'), false())]"
+                  },
+                  "settings": {
+                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'settings'), createObject())]"
+                  },
+                  "supressFailures": {
+                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'supressFailures'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'tags'), parameters('tags'))]"
+                  },
+                  "protectedSettings": {
+                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'protectedSettings'), createObject())]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "8482591295619883067"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension."
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_networkWatcherAgentExtension"
+              ]
+            },
+            "vm_customScriptExtension": {
+              "condition": "[parameters('extensionCustomScriptConfig').enabled]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-CustomScriptExtension', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "CustomScriptExtension"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'Microsoft.Compute'), createObject('value', 'Microsoft.Azure.Extensions'))]",
+                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'CustomScriptExtension'), createObject('value', 'CustomScript'))]",
+                  "typeHandlerVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'typeHandlerVersion'), if(equals(parameters('osType'), 'Windows'), '1.10', '2.1'))]"
+                  },
+                  "autoUpgradeMinorVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'autoUpgradeMinorVersion'), true())]"
+                  },
+                  "enableAutomaticUpgrade": {
+                    "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'enableAutomaticUpgrade'), false())]"
+                  },
+                  "settings": {
+                    "value": {
+                      "copy": [
+                        {
+                          "name": "fileUris",
+                          "count": "[length(parameters('extensionCustomScriptConfig').fileData)]",
+                          "input": "[if(contains(parameters('extensionCustomScriptConfig').fileData[copyIndex('fileUris')], 'storageAccountId'), format('{0}?{1}', parameters('extensionCustomScriptConfig').fileData[copyIndex('fileUris')].uri, listAccountSas(parameters('extensionCustomScriptConfig').fileData[copyIndex('fileUris')].storageAccountId, '2019-04-01', variables('accountSasProperties')).accountSasToken), parameters('extensionCustomScriptConfig').fileData[copyIndex('fileUris')].uri)]"
+                        }
+                      ]
+                    }
+                  },
+                  "supressFailures": {
+                    "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'supressFailures'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'tags'), parameters('tags'))]"
+                  },
+                  "protectedSettings": {
+                    "value": "[parameters('extensionCustomScriptProtectedSetting')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "8482591295619883067"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension."
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_desiredStateConfigurationExtension"
+              ]
+            },
+            "vm_azureDiskEncryptionExtension": {
+              "condition": "[parameters('extensionAzureDiskEncryptionConfig').enabled]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-AzureDiskEncryption', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "AzureDiskEncryption"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": {
+                    "value": "Microsoft.Azure.Security"
+                  },
+                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AzureDiskEncryption'), createObject('value', 'AzureDiskEncryptionForLinux'))]",
+                  "typeHandlerVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'typeHandlerVersion'), if(equals(parameters('osType'), 'Windows'), '2.2', '1.1'))]"
+                  },
+                  "autoUpgradeMinorVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'autoUpgradeMinorVersion'), true())]"
+                  },
+                  "enableAutomaticUpgrade": {
+                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'enableAutomaticUpgrade'), false())]"
+                  },
+                  "forceUpdateTag": {
+                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'forceUpdateTag'), '1.0')]"
+                  },
+                  "settings": {
+                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'settings'), createObject())]"
+                  },
+                  "supressFailures": {
+                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'supressFailures'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'tags'), parameters('tags'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "8482591295619883067"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension."
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_customScriptExtension"
+              ]
+            },
+            "vm_nvidiaGpuDriverWindowsExtension": {
+              "condition": "[parameters('extensionNvidiaGpuDriverWindows').enabled]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-NvidiaGpuDriverWindows', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "NvidiaGpuDriverWindows"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": {
+                    "value": "Microsoft.HpcCompute"
+                  },
+                  "type": {
+                    "value": "NvidiaGpuDriverWindows"
+                  },
+                  "typeHandlerVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'typeHandlerVersion'), '1.4')]"
+                  },
+                  "autoUpgradeMinorVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'autoUpgradeMinorVersion'), true())]"
+                  },
+                  "enableAutomaticUpgrade": {
+                    "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'enableAutomaticUpgrade'), false())]"
+                  },
+                  "supressFailures": {
+                    "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'supressFailures'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'tags'), parameters('tags'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "8482591295619883067"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension."
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_azureDiskEncryptionExtension"
+              ]
+            },
+            "vm_hostPoolRegistrationExtension": {
+              "condition": "[parameters('extensionHostPoolRegistration').enabled]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-HostPoolRegistration', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "HostPoolRegistration"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": {
+                    "value": "Microsoft.PowerShell"
+                  },
+                  "type": {
+                    "value": "DSC"
+                  },
+                  "typeHandlerVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'typeHandlerVersion'), '2.77')]"
+                  },
+                  "autoUpgradeMinorVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'autoUpgradeMinorVersion'), true())]"
+                  },
+                  "enableAutomaticUpgrade": {
+                    "value": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'enableAutomaticUpgrade'), false())]"
+                  },
+                  "settings": {
+                    "value": {
+                      "modulesUrl": "[parameters('extensionHostPoolRegistration').modulesUrl]",
+                      "configurationFunction": "[parameters('extensionHostPoolRegistration').configurationFunction]",
+                      "properties": {
+                        "hostPoolName": "[parameters('extensionHostPoolRegistration').hostPoolName]",
+                        "registrationInfoToken": "[parameters('extensionHostPoolRegistration').registrationInfoToken]",
+                        "aadJoin": true
+                      },
+                      "supressFailures": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'supressFailures'), false())]"
+                    }
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'tags'), parameters('tags'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "8482591295619883067"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension."
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_nvidiaGpuDriverWindowsExtension"
+              ]
+            },
+            "vm_azureGuestConfigurationExtension": {
+              "condition": "[parameters('extensionGuestConfigurationExtension').enabled]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-GuestConfiguration', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AzurePolicyforWindows'), createObject('value', 'AzurePolicyforLinux'))]",
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": {
+                    "value": "Microsoft.GuestConfiguration"
+                  },
+                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'ConfigurationforWindows'), createObject('value', 'ConfigurationForLinux'))]",
+                  "typeHandlerVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'typeHandlerVersion'), if(equals(parameters('osType'), 'Windows'), '1.0', '1.0'))]"
+                  },
+                  "autoUpgradeMinorVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'autoUpgradeMinorVersion'), true())]"
+                  },
+                  "enableAutomaticUpgrade": {
+                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'enableAutomaticUpgrade'), true())]"
+                  },
+                  "forceUpdateTag": {
+                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'forceUpdateTag'), '1.0')]"
+                  },
+                  "settings": {
+                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'settings'), createObject())]"
+                  },
+                  "supressFailures": {
+                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'supressFailures'), false())]"
+                  },
+                  "protectedSettings": {
+                    "value": "[parameters('extensionGuestConfigurationExtensionProtectedSettings')]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'tags'), parameters('tags'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "8482591295619883067"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension."
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_hostPoolRegistrationExtension"
+              ]
+            },
+            "vm_backup": {
+              "condition": "[not(empty(parameters('backupVaultName')))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-Backup', uniqueString(deployment().name, parameters('location')))]",
+              "resourceGroup": "[parameters('backupVaultResourceGroup')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[format('vm;iaasvmcontainerv2;{0};{1}', resourceGroup().name, parameters('name'))]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "policyId": {
+                    "value": "[resourceId('Microsoft.RecoveryServices/vaults/backupPolicies', parameters('backupVaultName'), parameters('backupPolicyName'))]"
+                  },
+                  "protectedItemType": {
+                    "value": "Microsoft.Compute/virtualMachines"
+                  },
+                  "protectionContainerName": {
+                    "value": "[format('iaasvmcontainer;iaasvmcontainerv2;{0};{1}', resourceGroup().name, parameters('name'))]"
+                  },
+                  "recoveryVaultName": {
+                    "value": "[parameters('backupVaultName')]"
+                  },
+                  "sourceResourceId": {
+                    "value": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "7743264001610407207"
+                    },
+                    "name": "Recovery Service Vaults Protection Container Protected Item",
+                    "description": "This module deploys a Recovery Services Vault Protection Container Protected Item."
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the resource."
+                      }
+                    },
+                    "protectionContainerName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. Name of the Azure Recovery Service Vault Protection Container. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "recoveryVaultName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Azure Recovery Service Vault. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "protectedItemType": {
+                      "type": "string",
+                      "allowedValues": [
+                        "AzureFileShareProtectedItem",
+                        "AzureVmWorkloadSAPAseDatabase",
+                        "AzureVmWorkloadSAPHanaDatabase",
+                        "AzureVmWorkloadSQLDatabase",
+                        "DPMProtectedItem",
+                        "GenericProtectedItem",
+                        "MabFileFolderProtectedItem",
+                        "Microsoft.ClassicCompute/virtualMachines",
+                        "Microsoft.Compute/virtualMachines",
+                        "Microsoft.Sql/servers/databases"
+                      ],
+                      "metadata": {
+                        "description": "Required. The backup item type."
+                      }
+                    },
+                    "policyId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. ID of the backup policy with which this item is backed up."
+                      }
+                    },
+                    "sourceResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Resource ID of the resource to back up."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems",
+                      "apiVersion": "2023-01-01",
+                      "name": "[format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "properties": {
+                        "protectedItemType": "[parameters('protectedItemType')]",
+                        "policyId": "[parameters('policyId')]",
+                        "sourceResourceId": "[parameters('sourceResourceId')]"
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the protected item was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the protected item."
+                      },
+                      "value": "[resourceId('Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems', split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[0], split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[1], split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[2], split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[3])]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The Name of the protected item."
+                      },
+                      "value": "[format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name'))]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_azureGuestConfigurationExtension"
+              ]
+            }
+          },
+          "outputs": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the VM."
+              },
+              "value": "[parameters('name')]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the VM."
+              },
+              "value": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
+            },
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the resource group the VM was created in."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "systemAssignedMIPrincipalId": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "The principal ID of the system assigned identity."
+              },
+              "value": "[tryGet(tryGet(reference('vm', '2024-07-01', 'full'), 'identity'), 'principalId')]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('vm', '2024-07-01', 'full').location]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "logAnalyticsWorkspace",
+        "virtualNetwork"
+      ]
+    },
+    "privateDnsZonesAiServices": {
+      "copy": {
+        "name": "privateDnsZonesAiServices",
+        "count": "[length(objectKeys(variables('openAiPrivateDnsZones')))]"
+      },
+      "condition": "[and(variables('virtualNetworkEnabled'), variables('aiFoundryAIservicesEnabled'))]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('avm.res.network.private-dns-zone.ai-services.{0}.{1}', uniqueString(variables('aiFoundryAiServicesResourceName'), objectKeys(variables('openAiPrivateDnsZones'))[copyIndex()]), parameters('solutionPrefix')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[objectKeys(variables('openAiPrivateDnsZones'))[copyIndex()]]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "virtualNetworkLinks": {
+            "value": [
+              {
+                "name": "[format('vnetlink-{0}', split(objectKeys(variables('openAiPrivateDnsZones'))[copyIndex()], '.')[1])]",
+                "virtualNetworkResourceId": "[reference('virtualNetwork').outputs.resourceId.value]"
+              }
+            ]
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.34.44.8038",
+              "templateHash": "4533956061065498344"
+            },
+            "name": "Private DNS Zones",
+            "description": "This module deploys a Private DNS zone."
+          },
+          "definitions": {
+            "aType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the record."
+                  }
+                },
+                "metadata": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The metadata of the record."
+                  }
+                },
+                "ttl": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The TTL of the record."
+                  }
+                },
+                "roleAssignments": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/roleAssignmentType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Array of role assignments to create."
+                  }
+                },
+                "aRecords": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "ipv4Address": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The IPv4 address of this A record."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The list of A records in the record set."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for the A record."
+              }
+            },
+            "aaaaType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the record."
+                  }
+                },
+                "metadata": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The metadata of the record."
+                  }
+                },
+                "ttl": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The TTL of the record."
+                  }
+                },
+                "roleAssignments": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/roleAssignmentType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Array of role assignments to create."
+                  }
+                },
+                "aaaaRecords": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "ipv6Address": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The IPv6 address of this AAAA record."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The list of AAAA records in the record set."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for the AAAA record."
+              }
+            },
+            "cnameType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the record."
+                  }
+                },
+                "metadata": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The metadata of the record."
+                  }
+                },
+                "ttl": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The TTL of the record."
+                  }
+                },
+                "roleAssignments": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/roleAssignmentType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Array of role assignments to create."
+                  }
+                },
+                "cnameRecord": {
+                  "type": "object",
+                  "properties": {
+                    "cname": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The canonical name of the CNAME record."
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The CNAME record in the record set."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for the CNAME record."
+              }
+            },
+            "mxType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the record."
+                  }
+                },
+                "metadata": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The metadata of the record."
+                  }
+                },
+                "ttl": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The TTL of the record."
+                  }
+                },
+                "roleAssignments": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/roleAssignmentType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Array of role assignments to create."
+                  }
+                },
+                "mxRecords": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "exchange": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The domain name of the mail host for this MX record."
+                        }
+                      },
+                      "preference": {
+                        "type": "int",
+                        "metadata": {
+                          "description": "Required. The preference value for this MX record."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The list of MX records in the record set."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for the MX record."
+              }
+            },
+            "ptrType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the record."
+                  }
+                },
+                "metadata": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The metadata of the record."
+                  }
+                },
+                "ttl": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The TTL of the record."
+                  }
+                },
+                "roleAssignments": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/roleAssignmentType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Array of role assignments to create."
+                  }
+                },
+                "ptrRecords": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "ptrdname": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The PTR target domain name for this PTR record."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The list of PTR records in the record set."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for the PTR record."
+              }
+            },
+            "soaType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the record."
+                  }
+                },
+                "metadata": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The metadata of the record."
+                  }
+                },
+                "ttl": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The TTL of the record."
+                  }
+                },
+                "roleAssignments": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/roleAssignmentType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Array of role assignments to create."
+                  }
+                },
+                "soaRecord": {
+                  "type": "object",
+                  "properties": {
+                    "email": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The email contact for this SOA record."
+                      }
+                    },
+                    "expireTime": {
+                      "type": "int",
+                      "metadata": {
+                        "description": "Required. The expire time for this SOA record."
+                      }
+                    },
+                    "host": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The domain name of the authoritative name server for this SOA record."
+                      }
+                    },
+                    "minimumTtl": {
+                      "type": "int",
+                      "metadata": {
+                        "description": "Required. The minimum value for this SOA record. By convention this is used to determine the negative caching duration."
+                      }
+                    },
+                    "refreshTime": {
+                      "type": "int",
+                      "metadata": {
+                        "description": "Required. The refresh value for this SOA record."
+                      }
+                    },
+                    "retryTime": {
+                      "type": "int",
+                      "metadata": {
+                        "description": "Required. The retry time for this SOA record."
+                      }
+                    },
+                    "serialNumber": {
+                      "type": "int",
+                      "metadata": {
+                        "description": "Required. The serial number for this SOA record."
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The SOA record in the record set."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for the SOA record."
+              }
+            },
+            "srvType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the record."
+                  }
+                },
+                "metadata": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The metadata of the record."
+                  }
+                },
+                "ttl": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The TTL of the record."
+                  }
+                },
+                "roleAssignments": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/roleAssignmentType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Array of role assignments to create."
+                  }
+                },
+                "srvRecords": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "priority": {
+                        "type": "int",
+                        "metadata": {
+                          "description": "Required. The priority value for this SRV record."
+                        }
+                      },
+                      "weight": {
+                        "type": "int",
+                        "metadata": {
+                          "description": "Required. The weight value for this SRV record."
+                        }
+                      },
+                      "port": {
+                        "type": "int",
+                        "metadata": {
+                          "description": "Required. The port value for this SRV record."
+                        }
+                      },
+                      "target": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The target domain name for this SRV record."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The list of SRV records in the record set."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for the SRV record."
+              }
+            },
+            "txtType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the record."
+                  }
+                },
+                "metadata": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The metadata of the record."
+                  }
+                },
+                "ttl": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The TTL of the record."
+                  }
+                },
+                "roleAssignments": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/roleAssignmentType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Array of role assignments to create."
+                  }
+                },
+                "txtRecords": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "value": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
+                        "metadata": {
+                          "description": "Required. The text value of this TXT record."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The list of TXT records in the record set."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for the TXT record."
+              }
+            },
+            "virtualNetworkLinkType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "minLength": 1,
+                  "maxLength": 80,
+                  "metadata": {
+                    "description": "Optional. The resource name."
+                  }
+                },
+                "virtualNetworkResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource ID of the virtual network to link."
+                  }
+                },
+                "location": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Azure Region where the resource lives."
+                  }
+                },
+                "registrationEnabled": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Is auto-registration of virtual machine records in the virtual network in the Private DNS zone enabled?."
+                  }
+                },
+                "tags": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource tags."
+                  }
+                },
+                "resolutionPolicy": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Default",
+                    "NxDomainRedirect"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resolution type of the private-dns-zone fallback machanism."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for the virtual network link."
+              }
+            },
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a lock.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "roleAssignmentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                  }
+                },
+                "roleDefinitionIdOrName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                  }
+                },
+                "principalId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                  }
+                },
+                "principalType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Device",
+                    "ForeignGroup",
+                    "Group",
+                    "ServicePrincipal",
+                    "User"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The principal type of the assigned principal ID."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The description of the role assignment."
+                  }
+                },
+                "condition": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                  }
+                },
+                "conditionVersion": {
+                  "type": "string",
+                  "allowedValues": [
+                    "2.0"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Version of the condition."
+                  }
+                },
+                "delegatedManagedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a role assignment.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Private DNS zone name."
+              }
+            },
+            "a": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/aType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of A records."
+              }
+            },
+            "aaaa": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/aaaaType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of AAAA records."
+              }
+            },
+            "cname": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/cnameType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of CNAME records."
+              }
+            },
+            "mx": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/mxType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of MX records."
+              }
+            },
+            "ptr": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/ptrType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of PTR records."
+              }
+            },
+            "soa": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/soaType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of SOA records."
+              }
+            },
+            "srv": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/srvType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of SRV records."
+              }
+            },
+            "txt": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/txtType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of TXT records."
+              }
+            },
+            "virtualNetworkLinks": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/virtualNetworkLinkType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of custom objects describing vNet links of the DNS zone. Each object should contain properties 'virtualNetworkResourceId' and 'registrationEnabled'. The 'vnetResourceId' is a resource ID of a vNet to link, 'registrationEnabled' (bool) enables automatic DNS registration in the zone for the linked vNet."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "global",
+              "metadata": {
+                "description": "Optional. The location of the PrivateDNSZone. Should be global."
+              }
+            },
+            "roleAssignments": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/roleAssignmentType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the resource."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "formattedRoleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+              }
+            ],
+            "builtInRoleNames": {
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+            }
+          },
+          "resources": {
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.network-privatednszone.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "privateDnsZone": {
+              "type": "Microsoft.Network/privateDnsZones",
+              "apiVersion": "2020-06-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]"
+            },
+            "privateDnsZone_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.Network/privateDnsZones/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_roleAssignments": {
+              "copy": {
+                "name": "privateDnsZone_roleAssignments",
+                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.Network/privateDnsZones/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+              "properties": {
+                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_A": {
+              "copy": {
+                "name": "privateDnsZone_A",
+                "count": "[length(coalesce(parameters('a'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-ARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('a'), createArray())[copyIndex()].name]"
+                  },
+                  "aRecords": {
+                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'aRecords')]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "18243374258187942664"
+                    },
+                    "name": "Private DNS Zone A record",
+                    "description": "This module deploys a Private DNS Zone A record."
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the A record."
+                      }
+                    },
+                    "aRecords": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The list of A records in the record set."
+                      }
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The metadata attached to the record set."
+                      }
+                    },
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
+                      "metadata": {
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "A": {
+                      "type": "Microsoft.Network/privateDnsZones/A",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "aRecords": "[parameters('aRecords')]",
+                        "metadata": "[parameters('metadata')]",
+                        "ttl": "[parameters('ttl')]"
+                      }
+                    },
+                    "A_roleAssignments": {
+                      "copy": {
+                        "name": "A_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/A/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "A"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed A record."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed A record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed A record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_AAAA": {
+              "copy": {
+                "name": "privateDnsZone_AAAA",
+                "count": "[length(coalesce(parameters('aaaa'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-AAAARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('aaaa'), createArray())[copyIndex()].name]"
+                  },
+                  "aaaaRecords": {
+                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'aaaaRecords')]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "7322684246075092047"
+                    },
+                    "name": "Private DNS Zone AAAA record",
+                    "description": "This module deploys a Private DNS Zone AAAA record."
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the AAAA record."
+                      }
+                    },
+                    "aaaaRecords": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The list of AAAA records in the record set."
+                      }
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The metadata attached to the record set."
+                      }
+                    },
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
+                      "metadata": {
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "AAAA": {
+                      "type": "Microsoft.Network/privateDnsZones/AAAA",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "aaaaRecords": "[parameters('aaaaRecords')]",
+                        "metadata": "[parameters('metadata')]",
+                        "ttl": "[parameters('ttl')]"
+                      }
+                    },
+                    "AAAA_roleAssignments": {
+                      "copy": {
+                        "name": "AAAA_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/AAAA/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "AAAA"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed AAAA record."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed AAAA record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed AAAA record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_CNAME": {
+              "copy": {
+                "name": "privateDnsZone_CNAME",
+                "count": "[length(coalesce(parameters('cname'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-CNAMERecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('cname'), createArray())[copyIndex()].name]"
+                  },
+                  "cnameRecord": {
+                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'cnameRecord')]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "5264706240021075859"
+                    },
+                    "name": "Private DNS Zone CNAME record",
+                    "description": "This module deploys a Private DNS Zone CNAME record."
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the CNAME record."
+                      }
+                    },
+                    "cnameRecord": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. A CNAME record."
+                      }
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The metadata attached to the record set."
+                      }
+                    },
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
+                      "metadata": {
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "CNAME": {
+                      "type": "Microsoft.Network/privateDnsZones/CNAME",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "cnameRecord": "[parameters('cnameRecord')]",
+                        "metadata": "[parameters('metadata')]",
+                        "ttl": "[parameters('ttl')]"
+                      }
+                    },
+                    "CNAME_roleAssignments": {
+                      "copy": {
+                        "name": "CNAME_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/CNAME/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "CNAME"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed CNAME record."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed CNAME record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed CNAME record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_MX": {
+              "copy": {
+                "name": "privateDnsZone_MX",
+                "count": "[length(coalesce(parameters('mx'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-MXRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('mx'), createArray())[copyIndex()].name]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "mxRecords": {
+                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'mxRecords')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "13758189936483275969"
+                    },
+                    "name": "Private DNS Zone MX record",
+                    "description": "This module deploys a Private DNS Zone MX record."
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the MX record."
+                      }
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The metadata attached to the record set."
+                      }
+                    },
+                    "mxRecords": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The list of MX records in the record set."
+                      }
+                    },
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
+                      "metadata": {
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "MX": {
+                      "type": "Microsoft.Network/privateDnsZones/MX",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "metadata": "[parameters('metadata')]",
+                        "mxRecords": "[parameters('mxRecords')]",
+                        "ttl": "[parameters('ttl')]"
+                      }
+                    },
+                    "MX_roleAssignments": {
+                      "copy": {
+                        "name": "MX_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/MX/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "MX"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed MX record."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed MX record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed MX record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_PTR": {
+              "copy": {
+                "name": "privateDnsZone_PTR",
+                "count": "[length(coalesce(parameters('ptr'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-PTRRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('ptr'), createArray())[copyIndex()].name]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "ptrRecords": {
+                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'ptrRecords')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "11955164584650609753"
+                    },
+                    "name": "Private DNS Zone PTR record",
+                    "description": "This module deploys a Private DNS Zone PTR record."
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the PTR record."
+                      }
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The metadata attached to the record set."
+                      }
+                    },
+                    "ptrRecords": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The list of PTR records in the record set."
+                      }
+                    },
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
+                      "metadata": {
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "PTR": {
+                      "type": "Microsoft.Network/privateDnsZones/PTR",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "metadata": "[parameters('metadata')]",
+                        "ptrRecords": "[parameters('ptrRecords')]",
+                        "ttl": "[parameters('ttl')]"
+                      }
+                    },
+                    "PTR_roleAssignments": {
+                      "copy": {
+                        "name": "PTR_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/PTR/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "PTR"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed PTR record."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed PTR record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed PTR record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_SOA": {
+              "copy": {
+                "name": "privateDnsZone_SOA",
+                "count": "[length(coalesce(parameters('soa'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-SOARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('soa'), createArray())[copyIndex()].name]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "soaRecord": {
+                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'soaRecord')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "14626715835033259725"
+                    },
+                    "name": "Private DNS Zone SOA record",
+                    "description": "This module deploys a Private DNS Zone SOA record."
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the SOA record."
+                      }
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The metadata attached to the record set."
+                      }
+                    },
+                    "soaRecord": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. A SOA record."
+                      }
+                    },
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
+                      "metadata": {
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "SOA": {
+                      "type": "Microsoft.Network/privateDnsZones/SOA",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "metadata": "[parameters('metadata')]",
+                        "soaRecord": "[parameters('soaRecord')]",
+                        "ttl": "[parameters('ttl')]"
+                      }
+                    },
+                    "SOA_roleAssignments": {
+                      "copy": {
+                        "name": "SOA_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/SOA/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "SOA"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed SOA record."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed SOA record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed SOA record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_SRV": {
+              "copy": {
+                "name": "privateDnsZone_SRV",
+                "count": "[length(coalesce(parameters('srv'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-SRVRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('srv'), createArray())[copyIndex()].name]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "srvRecords": {
+                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'srvRecords')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "6510442308165042737"
+                    },
+                    "name": "Private DNS Zone SRV record",
+                    "description": "This module deploys a Private DNS Zone SRV record."
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the SRV record."
+                      }
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The metadata attached to the record set."
+                      }
+                    },
+                    "srvRecords": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The list of SRV records in the record set."
+                      }
+                    },
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
+                      "metadata": {
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "SRV": {
+                      "type": "Microsoft.Network/privateDnsZones/SRV",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "metadata": "[parameters('metadata')]",
+                        "srvRecords": "[parameters('srvRecords')]",
+                        "ttl": "[parameters('ttl')]"
+                      }
+                    },
+                    "SRV_roleAssignments": {
+                      "copy": {
+                        "name": "SRV_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/SRV/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "SRV"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed SRV record."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed SRV record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed SRV record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_TXT": {
+              "copy": {
+                "name": "privateDnsZone_TXT",
+                "count": "[length(coalesce(parameters('txt'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-TXTRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('txt'), createArray())[copyIndex()].name]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "txtRecords": {
+                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'txtRecords')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "170623042781622569"
+                    },
+                    "name": "Private DNS Zone TXT record",
+                    "description": "This module deploys a Private DNS Zone TXT record."
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the TXT record."
+                      }
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The metadata attached to the record set."
+                      }
+                    },
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
+                      "metadata": {
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "txtRecords": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The list of TXT records in the record set."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "TXT": {
+                      "type": "Microsoft.Network/privateDnsZones/TXT",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "metadata": "[parameters('metadata')]",
+                        "ttl": "[parameters('ttl')]",
+                        "txtRecords": "[parameters('txtRecords')]"
+                      }
+                    },
+                    "TXT_roleAssignments": {
+                      "copy": {
+                        "name": "TXT_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/TXT/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "TXT"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed TXT record."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed TXT record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed TXT record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_virtualNetworkLinks": {
+              "copy": {
+                "name": "privateDnsZone_virtualNetworkLinks",
+                "count": "[length(coalesce(parameters('virtualNetworkLinks'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-VNetLink-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'name'), format('{0}-vnetlink', last(split(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()].virtualNetworkResourceId, '/'))))]"
+                  },
+                  "virtualNetworkResourceId": {
+                    "value": "[coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()].virtualNetworkResourceId]"
+                  },
+                  "location": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'location'), 'global')]"
+                  },
+                  "registrationEnabled": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'registrationEnabled'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                  },
+                  "resolutionPolicy": {
+                    "value": "[tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'resolutionPolicy')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "725891200086243555"
+                    },
+                    "name": "Private DNS Zone Virtual Network Link",
+                    "description": "This module deploys a Private DNS Zone Virtual Network Link."
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('{0}-vnetlink', last(split(parameters('virtualNetworkResourceId'), '/')))]",
+                      "metadata": {
+                        "description": "Optional. The name of the virtual network link."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "global",
+                      "metadata": {
+                        "description": "Optional. The location of the PrivateDNSZone. Should be global."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "registrationEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Is auto-registration of virtual machine records in the virtual network in the Private DNS zone enabled?."
+                      }
+                    },
+                    "virtualNetworkResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Link to another virtual network resource ID."
+                      }
+                    },
+                    "resolutionPolicy": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resolution policy on the virtual network link. Only applicable for virtual network links to privatelink zones, and for A,AAAA,CNAME queries. When set to `NxDomainRedirect`, Azure DNS resolver falls back to public resolution if private dns query resolution results in non-existent domain response. `Default` is configured as the default option."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "virtualNetworkLink": {
+                      "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
+                      "apiVersion": "2024-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "registrationEnabled": "[parameters('registrationEnabled')]",
+                        "virtualNetwork": {
+                          "id": "[parameters('virtualNetworkResourceId')]"
+                        },
+                        "resolutionPolicy": "[parameters('resolutionPolicy')]"
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed virtual network link."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed virtual network link."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/virtualNetworkLinks', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed virtual network link."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('virtualNetworkLink', '2024-06-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            }
+          },
+          "outputs": {
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group the private DNS zone was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the private DNS zone."
+              },
+              "value": "[parameters('name')]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the private DNS zone."
+              },
+              "value": "[resourceId('Microsoft.Network/privateDnsZones', parameters('name'))]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('privateDnsZone', '2020-06-01', 'full').location]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "virtualNetwork"
+      ]
+    },
+    "aiFoundryAiServices": {
+      "condition": "[variables('aiFoundryAIservicesEnabled')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('avm.res.cognitive-services.account.{0}', variables('aiFoundryAiServicesResourceName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[variables('aiFoundryAiServicesResourceName')]"
+          },
+          "tags": {
+            "value": "[coalesce(tryGet(parameters('aiFoundryAiServicesConfiguration'), 'tags'), parameters('tags'))]"
+          },
+          "location": {
+            "value": "[coalesce(tryGet(parameters('aiFoundryAiServicesConfiguration'), 'location'), parameters('azureOpenAILocation'))]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "diagnosticSettings": {
+            "value": [
+              {
+                "workspaceResourceId": "[if(variables('useExistingWorkspace'), variables('existingWorkspaceResourceId'), listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId)]"
+              }
+            ]
+          },
+          "sku": {
+            "value": "[coalesce(tryGet(parameters('aiFoundryAiServicesConfiguration'), 'sku'), 'S0')]"
+          },
+          "kind": {
+            "value": "AIServices"
+          },
+          "disableLocalAuth": {
+            "value": false
+          },
+          "customSubDomainName": {
+            "value": "[variables('aiFoundryAiServicesResourceName')]"
+          },
+          "apiProperties": {
+            "value": {}
+          },
+          "allowProjectManagement": {
+            "value": true
+          },
+          "managedIdentities": {
+            "value": {
+              "systemAssigned": true
+            }
+          },
+          "publicNetworkAccess": {
+            "value": "Enabled"
+          },
+          "privateEndpoints": "[if(variables('virtualNetworkEnabled'), createObject('value', createArray(createObject('name', format('pep-{0}', variables('aiFoundryAiServicesResourceName')), 'customNetworkInterfaceName', format('nic-{0}', variables('aiFoundryAiServicesResourceName')), 'subnetResourceId', coalesce(tryGet(parameters('aiFoundryAiServicesConfiguration'), 'subnetResourceId'), reference('virtualNetwork').outputs.subnetResourceIds.value[0]), 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', map(objectKeys(variables('openAiPrivateDnsZones')), lambda('zone', createObject('name', replace(lambdaVariables('zone'), '.', '-'), 'privateDnsZoneResourceId', resourceId('Microsoft.Network/privateDnsZones', lambdaVariables('zone'))))))))), createObject('value', createArray()))]",
+          "deployments": {
+            "value": "[coalesce(tryGet(parameters('aiFoundryAiServicesConfiguration'), 'deployments'), createArray(createObject('name', variables('aiFoundryAiServicesModelDeployment').name, 'model', createObject('format', variables('aiFoundryAiServicesModelDeployment').format, 'name', variables('aiFoundryAiServicesModelDeployment').name, 'version', variables('aiFoundryAiServicesModelDeployment').version), 'raiPolicyName', variables('aiFoundryAiServicesModelDeployment').raiPolicyName, 'sku', createObject('name', variables('aiFoundryAiServicesModelDeployment').sku.name, 'capacity', variables('aiFoundryAiServicesModelDeployment').sku.capacity))))]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.36.1.42791",
+              "templateHash": "16135659971302525380"
+            },
+            "name": "Cognitive Services",
+            "description": "This module deploys a Cognitive Service."
+          },
+          "definitions": {
+            "privateEndpointOutputType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "The name of the private endpoint."
+                  }
+                },
+                "resourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "The resource ID of the private endpoint."
+                  }
+                },
+                "groupId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "The group Id for the private endpoint Group."
+                  }
+                },
+                "customDnsConfigs": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "fqdn": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "FQDN that resolves to private endpoint IP address."
+                        }
+                      },
+                      "ipAddresses": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
+                        "metadata": {
+                          "description": "A list of private IP addresses of the private endpoint."
+                        }
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "The custom DNS configurations of the private endpoint."
+                  }
+                },
+                "networkInterfaceResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "metadata": {
+                    "description": "The IDs of the network interfaces associated with the private endpoint."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for the private endpoint output."
+              }
+            },
+            "deploymentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of cognitive service account deployment."
+                  }
+                },
+                "model": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of Cognitive Services account deployment model."
+                      }
+                    },
+                    "format": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The format of Cognitive Services account deployment model."
+                      }
+                    },
+                    "version": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The version of Cognitive Services account deployment model."
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. Properties of Cognitive Services account deployment model."
+                  }
+                },
+                "sku": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the resource model definition representing SKU."
+                      }
+                    },
+                    "capacity": {
+                      "type": "int",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The capacity of the resource model definition representing SKU."
+                      }
+                    },
+                    "tier": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The tier of the resource model definition representing SKU."
+                      }
+                    },
+                    "size": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The size of the resource model definition representing SKU."
+                      }
+                    },
+                    "family": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The family of the resource model definition representing SKU."
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource model definition representing SKU."
+                  }
+                },
+                "raiPolicyName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of RAI policy."
+                  }
+                },
+                "versionUpgradeOption": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The version upgrade option."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for a cognitive services account deployment."
+              }
+            },
+            "endpointType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Type of the endpoint."
+                  }
+                },
+                "endpoint": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "The endpoint URI."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for a cognitive services account endpoint."
+              }
+            },
+            "secretsExportConfigurationType": {
+              "type": "object",
+              "properties": {
+                "keyVaultResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The key vault name where to store the keys and connection strings generated by the modules."
+                  }
+                },
+                "accessKey1Name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name for the accessKey1 secret to create."
+                  }
+                },
+                "accessKey2Name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name for the accessKey2 secret to create."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type of the secrets exported to the provided Key Vault."
+              }
+            },
+            "_1.privateEndpointCustomDnsConfigType": {
+              "type": "object",
+              "properties": {
+                "fqdn": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                  }
+                },
+                "ipAddresses": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "metadata": {
+                    "description": "Required. A list of private IP addresses of the private endpoint."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointIpConfigurationType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the resource that is unique within a resource group."
+                  }
+                },
+                "properties": {
+                  "type": "object",
+                  "properties": {
+                    "groupId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                      }
+                    },
+                    "memberName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                      }
+                    },
+                    "privateIPAddress": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. Properties of private endpoint IP configurations."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointPrivateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "name": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The name of the private DNS Zone Group config."
+                        }
+                      },
+                      "privateDnsZoneResourceId": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The resource id of the private DNS zone."
+                        }
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.secretSetOutputType": {
+              "type": "object",
+              "properties": {
+                "secretResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "The resourceId of the exported secret."
+                  }
+                },
+                "secretUri": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "The secret URI of the exported secret."
+                  }
+                },
+                "secretUriWithVersion": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "The secret URI with version of the exported secret."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "customerManagedKeyType": {
+              "type": "object",
+              "properties": {
+                "keyVaultResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
+                  }
+                },
+                "keyName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the customer managed key to use for encryption."
+                  }
+                },
+                "keyVersion": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, the deployment will use the latest version available at deployment time."
+                  }
+                },
+                "userAssignedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type does not support auto-rotation of the customer-managed key.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "diagnosticSettingFullType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the diagnostic setting."
+                  }
+                },
+                "logCategoriesAndGroups": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "category": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                        }
+                      },
+                      "categoryGroup": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                        }
+                      },
+                      "enabled": {
+                        "type": "bool",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                  }
+                },
+                "metricCategories": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "category": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                        }
+                      },
+                      "enabled": {
+                        "type": "bool",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                  }
+                },
+                "logAnalyticsDestinationType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "AzureDiagnostics",
+                    "Dedicated"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                  }
+                },
+                "workspaceResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "storageAccountResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "eventHubAuthorizationRuleResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                  }
+                },
+                "eventHubName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "marketplacePartnerResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a lock.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "managedIdentityAllType": {
+              "type": "object",
+              "properties": {
+                "systemAssigned": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enables system assigned managed identity on the resource."
+                  }
+                },
+                "userAssignedResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "privateEndpointSingleServiceType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private Endpoint."
+                  }
+                },
+                "location": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The location to deploy the Private Endpoint to."
+                  }
+                },
+                "privateLinkServiceConnectionName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private link connection to create."
+                  }
+                },
+                "service": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                  }
+                },
+                "subnetResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                  }
+                },
+                "resourceGroupResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                  }
+                },
+                "privateDnsZoneGroup": {
+                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                  }
+                },
+                "isManualConnection": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. If Manual Private Link Connection is required."
+                  }
+                },
+                "manualConnectionRequestMessage": {
+                  "type": "string",
+                  "nullable": true,
+                  "maxLength": 140,
+                  "metadata": {
+                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                  }
+                },
+                "customDnsConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Custom DNS configurations."
+                  }
+                },
+                "ipConfigurations": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                  }
+                },
+                "applicationSecurityGroupResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                  }
+                },
+                "customNetworkInterfaceName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                  }
+                },
+                "lock": {
+                  "$ref": "#/definitions/lockType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                },
+                "roleAssignments": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/roleAssignmentType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Array of role assignments to create."
+                  }
+                },
+                "tags": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                  }
+                },
+                "enableTelemetry": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enable/Disable usage telemetry for module."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "roleAssignmentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                  }
+                },
+                "roleDefinitionIdOrName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                  }
+                },
+                "principalId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                  }
+                },
+                "principalType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Device",
+                    "ForeignGroup",
+                    "Group",
+                    "ServicePrincipal",
+                    "User"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The principal type of the assigned principal ID."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The description of the role assignment."
+                  }
+                },
+                "condition": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                  }
+                },
+                "conditionVersion": {
+                  "type": "string",
+                  "allowedValues": [
+                    "2.0"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Version of the condition."
+                  }
+                },
+                "delegatedManagedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a role assignment.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "secretsOutputType": {
+              "type": "object",
+              "properties": {},
+              "additionalProperties": {
+                "$ref": "#/definitions/_1.secretSetOutputType",
+                "metadata": {
+                  "description": "An exported secret's references."
+                }
+              },
+              "metadata": {
+                "description": "A map of the exported secrets",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. The name of Cognitive Services account."
+              }
+            },
+            "kind": {
+              "type": "string",
+              "allowedValues": [
+                "AIServices",
+                "AnomalyDetector",
+                "CognitiveServices",
+                "ComputerVision",
+                "ContentModerator",
+                "ContentSafety",
+                "ConversationalLanguageUnderstanding",
+                "CustomVision.Prediction",
+                "CustomVision.Training",
+                "Face",
+                "FormRecognizer",
+                "HealthInsights",
+                "ImmersiveReader",
+                "Internal.AllInOne",
+                "LUIS",
+                "LUIS.Authoring",
+                "LanguageAuthoring",
+                "MetricsAdvisor",
+                "OpenAI",
+                "Personalizer",
+                "QnAMaker.v2",
+                "SpeechServices",
+                "TextAnalytics",
+                "TextTranslation"
+              ],
+              "metadata": {
+                "description": "Required. Kind of the Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region."
+              }
+            },
+            "sku": {
+              "type": "string",
+              "defaultValue": "S0",
+              "allowedValues": [
+                "C2",
+                "C3",
+                "C4",
+                "F0",
+                "F1",
+                "S",
+                "S0",
+                "S1",
+                "S10",
+                "S2",
+                "S3",
+                "S4",
+                "S5",
+                "S6",
+                "S7",
+                "S8",
+                "S9"
+              ],
+              "metadata": {
+                "description": "Optional. SKU of the Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all Resources."
+              }
+            },
+            "diagnosticSettings": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/diagnosticSettingFullType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The diagnostic settings of the service."
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "nullable": true,
+              "allowedValues": [
+                "Enabled",
+                "Disabled"
+              ],
+              "metadata": {
+                "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set."
+              }
+            },
+            "customSubDomainName": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Conditional. Subdomain name used for token-based authentication. Required if 'networkAcls' or 'privateEndpoints' are set."
+              }
+            },
+            "networkAcls": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. A collection of rules governing the accessibility from specific network locations."
+              }
+            },
+            "privateEndpoints": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/privateEndpointSingleServiceType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "roleAssignments": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/roleAssignmentType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the resource."
+              }
+            },
+            "allowedFqdnList": {
+              "type": "array",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. List of allowed FQDN."
+              }
+            },
+            "apiProperties": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The API properties for special APIs."
+              }
+            },
+            "disableLocalAuth": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Allow only Azure AD authentication. Should be enabled for security reasons."
+              }
+            },
+            "customerManagedKey": {
+              "$ref": "#/definitions/customerManagedKeyType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The customer managed key definition."
+              }
+            },
+            "dynamicThrottlingEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. The flag to enable dynamic throttling."
+              }
+            },
+            "migrationToken": {
+              "type": "securestring",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Resource migration token."
+              }
+            },
+            "restore": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Restore a soft-deleted cognitive service at deployment time. Will fail if no such soft-deleted resource exists."
+              }
+            },
+            "restrictOutboundNetworkAccess": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Restrict outbound network access."
+              }
+            },
+            "userOwnedStorage": {
+              "type": "array",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The storage accounts for this resource."
+              }
+            },
+            "managedIdentities": {
+              "$ref": "#/definitions/managedIdentityAllType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The managed identity definition for this resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "deployments": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/deploymentType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of deployments about cognitive service accounts to create."
+              }
+            },
+            "secretsExportConfiguration": {
+              "$ref": "#/definitions/secretsExportConfigurationType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Key vault reference and secret settings for the module's secrets export."
+              }
+            },
+            "allowProjectManagement": {
+              "type": "bool",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable project management feature for AI Foundry."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "formattedRoleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+              }
+            ],
+            "enableReferencedModulesTelemetry": false,
+            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+            "builtInRoleNames": {
+              "Cognitive Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '25fbc0a9-bd7c-42a3-aa1a-3b75d497ee68')]",
+              "Cognitive Services Custom Vision Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c1ff6cc2-c111-46fe-8896-e0ef812ad9f3')]",
+              "Cognitive Services Custom Vision Deployment": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5c4089e1-6d96-4d2f-b296-c1bc7137275f')]",
+              "Cognitive Services Custom Vision Labeler": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '88424f51-ebe7-446f-bc41-7fa16989e96c')]",
+              "Cognitive Services Custom Vision Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '93586559-c37d-4a6b-ba08-b9f0940c2d73')]",
+              "Cognitive Services Custom Vision Trainer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a5ae4ab-0d65-4eeb-be61-29fc9b54394b')]",
+              "Cognitive Services Data Reader (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b59867f0-fa02-499b-be73-45a86b5b3e1c')]",
+              "Cognitive Services Face Recognizer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9894cab4-e18a-44aa-828b-cb588cd6f2d7')]",
+              "Cognitive Services Immersive Reader User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b2de6794-95db-4659-8781-7e080d3f2b9d')]",
+              "Cognitive Services Language Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f07febfe-79bc-46b1-8b37-790e26e6e498')]",
+              "Cognitive Services Language Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7628b7b8-a8b2-4cdc-b46f-e9b35248918e')]",
+              "Cognitive Services Language Writer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f2310ca1-dc64-4889-bb49-c8e0fa3d47a8')]",
+              "Cognitive Services LUIS Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f72c8140-2111-481c-87ff-72b910f6e3f8')]",
+              "Cognitive Services LUIS Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18e81cdc-4e98-4e29-a639-e7d10c5a6226')]",
+              "Cognitive Services LUIS Writer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6322a993-d5c9-4bed-b113-e49bbea25b27')]",
+              "Cognitive Services Metrics Advisor Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'cb43c632-a144-4ec5-977c-e80c4affc34a')]",
+              "Cognitive Services Metrics Advisor User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3b20f47b-3825-43cb-8114-4bd2201156a8')]",
+              "Cognitive Services OpenAI Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a001fd3d-188f-4b5d-821b-7da978bf7442')]",
+              "Cognitive Services OpenAI User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd')]",
+              "Cognitive Services QnA Maker Editor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f4cc2bf9-21be-47a1-bdf1-5c5804381025')]",
+              "Cognitive Services QnA Maker Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '466ccd10-b268-4a11-b098-b4849f024126')]",
+              "Cognitive Services Speech Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0e75ca1e-0464-4b4d-8b93-68208a576181')]",
+              "Cognitive Services Speech User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f2dc8367-1007-4938-bd23-fe263f013447')]",
+              "Cognitive Services User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a97b65f3-24c7-4388-baec-2e87135dc908')]",
+              "Azure AI Developer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '64702f94-c441-49e6-a78b-ef80e0188fee')]",
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+            }
+          },
+          "resources": {
+            "cMKKeyVault::cMKKey": {
+              "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
+              "existing": true,
+              "type": "Microsoft.KeyVault/vaults/keys",
+              "apiVersion": "2023-07-01",
+              "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+              "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+              "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]"
+            },
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.cognitiveservices-account.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "cMKKeyVault": {
+              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]",
+              "existing": true,
+              "type": "Microsoft.KeyVault/vaults",
+              "apiVersion": "2023-07-01",
+              "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+              "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+              "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]"
+            },
+            "cMKUserAssignedIdentity": {
+              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
+              "existing": true,
+              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+              "apiVersion": "2025-01-31-preview",
+              "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]",
+              "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]",
+              "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]"
+            },
+            "cognitiveService": {
+              "type": "Microsoft.CognitiveServices/accounts",
+              "apiVersion": "2025-04-01-preview",
+              "name": "[parameters('name')]",
+              "kind": "[parameters('kind')]",
+              "identity": "[variables('identity')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "sku": {
+                "name": "[parameters('sku')]"
+              },
+              "properties": {
+                "allowProjectManagement": "[parameters('allowProjectManagement')]",
+                "customSubDomainName": "[parameters('customSubDomainName')]",
+                "networkAcls": "[if(not(empty(coalesce(parameters('networkAcls'), createObject()))), createObject('defaultAction', tryGet(parameters('networkAcls'), 'defaultAction'), 'virtualNetworkRules', coalesce(tryGet(parameters('networkAcls'), 'virtualNetworkRules'), createArray()), 'ipRules', coalesce(tryGet(parameters('networkAcls'), 'ipRules'), createArray())), null())]",
+                "publicNetworkAccess": "[if(not(equals(parameters('publicNetworkAccess'), null())), parameters('publicNetworkAccess'), if(not(empty(parameters('networkAcls'))), 'Enabled', 'Disabled'))]",
+                "allowedFqdnList": "[parameters('allowedFqdnList')]",
+                "apiProperties": "[parameters('apiProperties')]",
+                "disableLocalAuth": "[parameters('disableLocalAuth')]",
+                "encryption": "[if(not(empty(parameters('customerManagedKey'))), createObject('keySource', 'Microsoft.KeyVault', 'keyVaultProperties', createObject('identityClientId', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), ''))), reference('cMKUserAssignedIdentity').clientId, null()), 'keyVaultUri', reference('cMKKeyVault').vaultUri, 'keyName', parameters('customerManagedKey').keyName, 'keyVersion', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'keyVersion'), ''))), tryGet(parameters('customerManagedKey'), 'keyVersion'), last(split(reference('cMKKeyVault::cMKKey').keyUriWithVersion, '/'))))), null())]",
+                "migrationToken": "[parameters('migrationToken')]",
+                "restore": "[parameters('restore')]",
+                "restrictOutboundNetworkAccess": "[parameters('restrictOutboundNetworkAccess')]",
+                "userOwnedStorage": "[parameters('userOwnedStorage')]",
+                "dynamicThrottlingEnabled": "[parameters('dynamicThrottlingEnabled')]"
+              },
+              "dependsOn": [
+                "cMKKeyVault",
+                "cMKKeyVault::cMKKey",
+                "cMKUserAssignedIdentity"
+              ]
+            },
+            "cognitiveService_deployments": {
+              "copy": {
+                "name": "cognitiveService_deployments",
+                "count": "[length(coalesce(parameters('deployments'), createArray()))]",
+                "mode": "serial",
+                "batchSize": 1
+              },
+              "type": "Microsoft.CognitiveServices/accounts/deployments",
+              "apiVersion": "2025-04-01-preview",
+              "name": "[format('{0}/{1}', parameters('name'), coalesce(tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'name'), format('{0}-deployments', parameters('name'))))]",
+              "properties": {
+                "model": "[coalesce(parameters('deployments'), createArray())[copyIndex()].model]",
+                "raiPolicyName": "[tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'raiPolicyName')]",
+                "versionUpgradeOption": "[tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'versionUpgradeOption')]"
+              },
+              "sku": "[coalesce(tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'sku'), createObject('name', parameters('sku'), 'capacity', tryGet(parameters('sku'), 'capacity'), 'tier', tryGet(parameters('sku'), 'tier'), 'size', tryGet(parameters('sku'), 'size'), 'family', tryGet(parameters('sku'), 'family')))]",
+              "dependsOn": [
+                "cognitiveService"
+              ]
+            },
+            "cognitiveService_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "cognitiveService"
+              ]
+            },
+            "cognitiveService_diagnosticSettings": {
+              "copy": {
+                "name": "cognitiveService_diagnosticSettings",
+                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+              },
+              "type": "Microsoft.Insights/diagnosticSettings",
+              "apiVersion": "2021-05-01-preview",
+              "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "metrics",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                    "input": {
+                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                      "timeGrain": null
+                    }
+                  },
+                  {
+                    "name": "logs",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                    "input": {
+                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                    }
+                  }
+                ],
+                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+              },
+              "dependsOn": [
+                "cognitiveService"
+              ]
+            },
+            "cognitiveService_roleAssignments": {
+              "copy": {
+                "name": "cognitiveService_roleAssignments",
+                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+              "properties": {
+                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "cognitiveService"
+              ]
+            },
+            "cognitiveService_privateEndpoints": {
+              "copy": {
+                "name": "cognitiveService_privateEndpoints",
+                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-cognitiveService-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+              "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex()))]"
+                  },
+                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account')))))), createObject('value', null()))]",
+                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                  "subnetResourceId": {
+                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                  },
+                  "location": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                  },
+                  "lock": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                  },
+                  "privateDnsZoneGroup": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                  },
+                  "customDnsConfigs": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                  },
+                  "ipConfigurations": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                  },
+                  "applicationSecurityGroupResourceIds": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                  },
+                  "customNetworkInterfaceName": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "12389807800450456797"
+                    },
+                    "name": "Private Endpoints",
+                    "description": "This module deploys a Private Endpoint."
+                  },
+                  "definitions": {
+                    "privateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "ipConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "privateLinkServiceConnectionType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the private link service connection."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
+                              }
+                            },
+                            "privateLinkServiceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The resource id of private link service."
+                              }
+                            },
+                            "requestMessage": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private link service connection."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "customDnsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "private-dns-zone-group/main.bicep"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the private endpoint resource to create."
+                      }
+                    },
+                    "subnetResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                      }
+                    },
+                    "applicationSecurityGroupResourceIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                      }
+                    },
+                    "customNetworkInterfaceName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                      }
+                    },
+                    "ipConfigurations": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/ipConfigurationType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                      }
+                    },
+                    "privateDnsZoneGroup": {
+                      "$ref": "#/definitions/privateDnsZoneGroupType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                      }
+                    },
+                    "customDnsConfigs": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/customDnsConfigType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Custom DNS configurations."
+                      }
+                    },
+                    "manualPrivateLinkServiceConnections": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateLinkServiceConnectionType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                      }
+                    },
+                    "privateLinkServiceConnections": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateLinkServiceConnectionType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "privateEndpoint": {
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2024-05-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "applicationSecurityGroups",
+                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                            "input": {
+                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                            }
+                          }
+                        ],
+                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                        "subnet": {
+                          "id": "[parameters('subnetResourceId')]"
+                        }
+                      }
+                    },
+                    "privateEndpoint_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    },
+                    "privateEndpoint_roleAssignments": {
+                      "copy": {
+                        "name": "privateEndpoint_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    },
+                    "privateEndpoint_privateDnsZoneGroup": {
+                      "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                          },
+                          "privateEndpointName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "privateDnsZoneConfigs": {
+                            "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.34.44.8038",
+                              "templateHash": "13997305779829540948"
+                            },
+                            "name": "Private Endpoint Private DNS Zone Groups",
+                            "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                          },
+                          "definitions": {
+                            "privateDnsZoneGroupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private DNS zone group config."
+                                  }
+                                },
+                                "privateDnsZoneResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource id of the private DNS zone."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "privateEndpointName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "privateDnsZoneConfigs": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                              },
+                              "minLength": 1,
+                              "maxLength": 5,
+                              "metadata": {
+                                "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "default",
+                              "metadata": {
+                                "description": "Optional. The name of the private DNS zone group."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "privateDnsZoneConfigsVar",
+                                "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                "input": {
+                                  "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
+                                  "properties": {
+                                    "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
+                                  }
+                                }
+                              }
+                            ]
+                          },
+                          "resources": {
+                            "privateEndpoint": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateEndpoints",
+                              "apiVersion": "2024-05-01",
+                              "name": "[parameters('privateEndpointName')]"
+                            },
+                            "privateDnsZoneGroup": {
+                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                              "apiVersion": "2024-05-01",
+                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                              "properties": {
+                                "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private endpoint DNS zone group."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private endpoint DNS zone group."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private endpoint DNS zone group was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the private endpoint was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the private endpoint."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the private endpoint."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]"
+                    },
+                    "customDnsConfigs": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/customDnsConfigType"
+                      },
+                      "metadata": {
+                        "description": "The custom DNS configurations of the private endpoint."
+                      },
+                      "value": "[reference('privateEndpoint').customDnsConfigs]"
+                    },
+                    "networkInterfaceResourceIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "metadata": {
+                        "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                      },
+                      "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                    },
+                    "groupId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The group Id for the private endpoint Group."
+                      },
+                      "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "cognitiveService"
+              ]
+            },
+            "secretsExport": {
+              "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]",
+              "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]",
+              "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "keyVaultName": {
+                    "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]"
+                  },
+                  "secretsToSet": {
+                    "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'accessKey1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey1Name'), 'value', listKeys('cognitiveService', '2025-04-01-preview').key1)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'accessKey2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey2Name'), 'value', listKeys('cognitiveService', '2025-04-01-preview').key2)), createArray()))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.36.1.42791",
+                      "templateHash": "1200612323329026557"
+                    }
+                  },
+                  "definitions": {
+                    "secretSetOutputType": {
+                      "type": "object",
+                      "properties": {
+                        "secretResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The resourceId of the exported secret."
+                          }
+                        },
+                        "secretUri": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The secret URI of the exported secret."
+                          }
+                        },
+                        "secretUriWithVersion": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The secret URI with version of the exported secret."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "secretToSetType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the secret to set."
+                          }
+                        },
+                        "value": {
+                          "type": "securestring",
+                          "metadata": {
+                            "description": "Required. The value of the secret to set."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for the secret to set via the secrets export feature.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "keyVaultName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the Key Vault to set the ecrets in."
+                      }
+                    },
+                    "secretsToSet": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/secretToSetType"
+                      },
+                      "metadata": {
+                        "description": "Required. The secrets to set in the Key Vault."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "keyVault": {
+                      "existing": true,
+                      "type": "Microsoft.KeyVault/vaults",
+                      "apiVersion": "2023-07-01",
+                      "name": "[parameters('keyVaultName')]"
+                    },
+                    "secrets": {
+                      "copy": {
+                        "name": "secrets",
+                        "count": "[length(parameters('secretsToSet'))]"
+                      },
+                      "type": "Microsoft.KeyVault/vaults/secrets",
+                      "apiVersion": "2023-07-01",
+                      "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]",
+                      "properties": {
+                        "value": "[parameters('secretsToSet')[copyIndex()].value]"
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "secretsSet": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/secretSetOutputType"
+                      },
+                      "metadata": {
+                        "description": "The references to the secrets exported to the provided Key Vault."
+                      },
+                      "copy": {
+                        "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]",
+                        "input": {
+                          "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]",
+                          "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]",
+                          "secretUriWithVersion": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUriWithVersion]"
+                        }
+                      }
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "cognitiveService"
+              ]
+            }
+          },
+          "outputs": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the cognitive services account."
+              },
+              "value": "[parameters('name')]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the cognitive services account."
+              },
+              "value": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]"
+            },
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group the cognitive services account was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "endpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "The service endpoint of the cognitive services account."
+              },
+              "value": "[reference('cognitiveService').endpoint]"
+            },
+            "endpoints": {
+              "$ref": "#/definitions/endpointType",
+              "metadata": {
+                "description": "All endpoints available for the cognitive services account, types depends on the cognitive service kind."
+              },
+              "value": "[reference('cognitiveService').endpoints]"
+            },
+            "systemAssignedMIPrincipalId": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "The principal ID of the system assigned identity."
+              },
+              "value": "[tryGet(tryGet(reference('cognitiveService', '2025-04-01-preview', 'full'), 'identity'), 'principalId')]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('cognitiveService', '2025-04-01-preview', 'full').location]"
+            },
+            "exportedSecrets": {
+              "$ref": "#/definitions/secretsOutputType",
+              "metadata": {
+                "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name."
+              },
+              "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]"
+            },
+            "privateEndpoints": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/privateEndpointOutputType"
+              },
+              "metadata": {
+                "description": "The private endpoints of the congitive services account."
+              },
+              "copy": {
+                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                "input": {
+                  "name": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                  "resourceId": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                  "groupId": "[tryGet(tryGet(reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                  "customDnsConfigs": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                  "networkInterfaceResourceIds": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                }
+              }
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "logAnalyticsWorkspace",
+        "virtualNetwork"
+      ]
+    },
+    "privateDnsZonesCosmosDb": {
+      "condition": "[variables('virtualNetworkEnabled')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('avm.res.network.private-dns-zone.cosmos-db.{0}', parameters('solutionPrefix')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "privatelink.documents.azure.com"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "virtualNetworkLinks": {
+            "value": [
+              {
+                "name": "vnetlink-cosmosdb",
+                "virtualNetworkResourceId": "[reference('virtualNetwork').outputs.resourceId.value]"
+              }
+            ]
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.32.4.45862",
+              "templateHash": "83178825086050429"
+            },
+            "name": "Private DNS Zones",
+            "description": "This module deploys a Private DNS zone.",
+            "owner": "Azure/module-maintainers"
+          },
+          "definitions": {
+            "roleAssignmentType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                    }
+                  },
+                  "roleDefinitionIdOrName": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                    }
+                  },
+                  "principalId": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                    }
+                  },
+                  "principalType": {
+                    "type": "string",
+                    "allowedValues": [
+                      "Device",
+                      "ForeignGroup",
+                      "Group",
+                      "ServicePrincipal",
+                      "User"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The principal type of the assigned principal ID."
+                    }
+                  },
+                  "description": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The description of the role assignment."
+                    }
+                  },
+                  "condition": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                    }
+                  },
+                  "conditionVersion": {
+                    "type": "string",
+                    "allowedValues": [
+                      "2.0"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Version of the condition."
+                    }
+                  },
+                  "delegatedManagedIdentityResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "aType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The name of the record."
+                    }
+                  },
+                  "metadata": {
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The metadata of the record."
+                    }
+                  },
+                  "ttl": {
+                    "type": "int",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The TTL of the record."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "aRecords": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "ipv4Address": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The IPv4 address of this A record."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The list of A records in the record set."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "aaaaType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The name of the record."
+                    }
+                  },
+                  "metadata": {
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The metadata of the record."
+                    }
+                  },
+                  "ttl": {
+                    "type": "int",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The TTL of the record."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "aaaaRecords": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "ipv6Address": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The IPv6 address of this AAAA record."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The list of AAAA records in the record set."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "cnameType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The name of the record."
+                    }
+                  },
+                  "metadata": {
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The metadata of the record."
+                    }
+                  },
+                  "ttl": {
+                    "type": "int",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The TTL of the record."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "cnameRecord": {
+                    "type": "object",
+                    "properties": {
+                      "cname": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The canonical name of the CNAME record."
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The CNAME record in the record set."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "mxType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The name of the record."
+                    }
+                  },
+                  "metadata": {
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The metadata of the record."
+                    }
+                  },
+                  "ttl": {
+                    "type": "int",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The TTL of the record."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "mxRecords": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "exchange": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The domain name of the mail host for this MX record."
+                          }
+                        },
+                        "preference": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The preference value for this MX record."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The list of MX records in the record set."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "ptrType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The name of the record."
+                    }
+                  },
+                  "metadata": {
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The metadata of the record."
+                    }
+                  },
+                  "ttl": {
+                    "type": "int",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The TTL of the record."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "ptrRecords": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "ptrdname": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The PTR target domain name for this PTR record."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The list of PTR records in the record set."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "soaType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The name of the record."
+                    }
+                  },
+                  "metadata": {
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The metadata of the record."
+                    }
+                  },
+                  "ttl": {
+                    "type": "int",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The TTL of the record."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "soaRecord": {
+                    "type": "object",
+                    "properties": {
+                      "email": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The email contact for this SOA record."
+                        }
+                      },
+                      "expireTime": {
+                        "type": "int",
+                        "metadata": {
+                          "description": "Required. The expire time for this SOA record."
+                        }
+                      },
+                      "host": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The domain name of the authoritative name server for this SOA record."
+                        }
+                      },
+                      "minimumTtl": {
+                        "type": "int",
+                        "metadata": {
+                          "description": "Required. The minimum value for this SOA record. By convention this is used to determine the negative caching duration."
+                        }
+                      },
+                      "refreshTime": {
+                        "type": "int",
+                        "metadata": {
+                          "description": "Required. The refresh value for this SOA record."
+                        }
+                      },
+                      "retryTime": {
+                        "type": "int",
+                        "metadata": {
+                          "description": "Required. The retry time for this SOA record."
+                        }
+                      },
+                      "serialNumber": {
+                        "type": "int",
+                        "metadata": {
+                          "description": "Required. The serial number for this SOA record."
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The SOA record in the record set."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "srvType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The name of the record."
+                    }
+                  },
+                  "metadata": {
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The metadata of the record."
+                    }
+                  },
+                  "ttl": {
+                    "type": "int",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The TTL of the record."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "srvRecords": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "priority": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The priority value for this SRV record."
+                          }
+                        },
+                        "weight": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The weight value for this SRV record."
+                          }
+                        },
+                        "port": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The port value for this SRV record."
+                          }
+                        },
+                        "target": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The target domain name for this SRV record."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The list of SRV records in the record set."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "txtType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The name of the record."
+                    }
+                  },
+                  "metadata": {
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The metadata of the record."
+                    }
+                  },
+                  "ttl": {
+                    "type": "int",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The TTL of the record."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "txtRecords": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "value": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. The text value of this TXT record."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The list of TXT records in the record set."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "virtualNetworkLinkType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "nullable": true,
+                    "minLength": 1,
+                    "maxLength": 80,
+                    "metadata": {
+                      "description": "Optional. The resource name."
+                    }
+                  },
+                  "virtualNetworkResourceId": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The resource ID of the virtual network to link."
+                    }
+                  },
+                  "location": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The Azure Region where the resource lives."
+                    }
+                  },
+                  "registrationEnabled": {
+                    "type": "bool",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Is auto-registration of virtual machine records in the virtual network in the Private DNS zone enabled?."
+                    }
+                  },
+                  "tags": {
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource tags."
+                    }
+                  },
+                  "resolutionPolicy": {
+                    "type": "string",
+                    "allowedValues": [
+                      "Default",
+                      "NxDomainRedirect"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The resolution type of the private-dns-zone fallback machanism."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Private DNS zone name."
+              }
+            },
+            "a": {
+              "$ref": "#/definitions/aType",
+              "metadata": {
+                "description": "Optional. Array of A records."
+              }
+            },
+            "aaaa": {
+              "$ref": "#/definitions/aaaaType",
+              "metadata": {
+                "description": "Optional. Array of AAAA records."
+              }
+            },
+            "cname": {
+              "$ref": "#/definitions/cnameType",
+              "metadata": {
+                "description": "Optional. Array of CNAME records."
+              }
+            },
+            "mx": {
+              "$ref": "#/definitions/mxType",
+              "metadata": {
+                "description": "Optional. Array of MX records."
+              }
+            },
+            "ptr": {
+              "$ref": "#/definitions/ptrType",
+              "metadata": {
+                "description": "Optional. Array of PTR records."
+              }
+            },
+            "soa": {
+              "$ref": "#/definitions/soaType",
+              "metadata": {
+                "description": "Optional. Array of SOA records."
+              }
+            },
+            "srv": {
+              "$ref": "#/definitions/srvType",
+              "metadata": {
+                "description": "Optional. Array of SRV records."
+              }
+            },
+            "txt": {
+              "$ref": "#/definitions/txtType",
+              "metadata": {
+                "description": "Optional. Array of TXT records."
+              }
+            },
+            "virtualNetworkLinks": {
+              "$ref": "#/definitions/virtualNetworkLinkType",
+              "metadata": {
+                "description": "Optional. Array of custom objects describing vNet links of the DNS zone. Each object should contain properties 'virtualNetworkResourceId' and 'registrationEnabled'. The 'vnetResourceId' is a resource ID of a vNet to link, 'registrationEnabled' (bool) enables automatic DNS registration in the zone for the linked vNet."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "global",
+              "metadata": {
+                "description": "Optional. The location of the PrivateDNSZone. Should be global."
+              }
+            },
+            "roleAssignments": {
+              "$ref": "#/definitions/roleAssignmentType",
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the resource."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "formattedRoleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+              }
+            ],
+            "builtInRoleNames": {
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+            }
+          },
+          "resources": {
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.network-privatednszone.{0}.{1}', replace('0.7.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "privateDnsZone": {
+              "type": "Microsoft.Network/privateDnsZones",
+              "apiVersion": "2020-06-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]"
+            },
+            "privateDnsZone_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.Network/privateDnsZones/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_roleAssignments": {
+              "copy": {
+                "name": "privateDnsZone_roleAssignments",
+                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.Network/privateDnsZones/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+              "properties": {
+                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_A": {
+              "copy": {
+                "name": "privateDnsZone_A",
+                "count": "[length(coalesce(parameters('a'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-ARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('a'), createArray())[copyIndex()].name]"
+                  },
+                  "aRecords": {
+                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'aRecords')]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.32.4.45862",
+                      "templateHash": "2531120132215940282"
+                    },
+                    "name": "Private DNS Zone A record",
+                    "description": "This module deploys a Private DNS Zone A record.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                            }
+                          },
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the A record."
+                      }
+                    },
+                    "aRecords": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The list of A records in the record set."
+                      }
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The metadata attached to the record set."
+                      }
+                    },
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
+                      "metadata": {
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "A": {
+                      "type": "Microsoft.Network/privateDnsZones/A",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "aRecords": "[parameters('aRecords')]",
+                        "metadata": "[parameters('metadata')]",
+                        "ttl": "[parameters('ttl')]"
+                      }
+                    },
+                    "A_roleAssignments": {
+                      "copy": {
+                        "name": "A_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/A/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "A"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed A record."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed A record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed A record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_AAAA": {
+              "copy": {
+                "name": "privateDnsZone_AAAA",
+                "count": "[length(coalesce(parameters('aaaa'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-AAAARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('aaaa'), createArray())[copyIndex()].name]"
+                  },
+                  "aaaaRecords": {
+                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'aaaaRecords')]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.32.4.45862",
+                      "templateHash": "16709340450244912125"
+                    },
+                    "name": "Private DNS Zone AAAA record",
+                    "description": "This module deploys a Private DNS Zone AAAA record.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                            }
+                          },
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the AAAA record."
+                      }
+                    },
+                    "aaaaRecords": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The list of AAAA records in the record set."
+                      }
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The metadata attached to the record set."
+                      }
+                    },
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
+                      "metadata": {
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "AAAA": {
+                      "type": "Microsoft.Network/privateDnsZones/AAAA",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "aaaaRecords": "[parameters('aaaaRecords')]",
+                        "metadata": "[parameters('metadata')]",
+                        "ttl": "[parameters('ttl')]"
+                      }
+                    },
+                    "AAAA_roleAssignments": {
+                      "copy": {
+                        "name": "AAAA_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/AAAA/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "AAAA"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed AAAA record."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed AAAA record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed AAAA record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_CNAME": {
+              "copy": {
+                "name": "privateDnsZone_CNAME",
+                "count": "[length(coalesce(parameters('cname'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-CNAMERecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('cname'), createArray())[copyIndex()].name]"
+                  },
+                  "cnameRecord": {
+                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'cnameRecord')]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.32.4.45862",
+                      "templateHash": "9976020649752073181"
+                    },
+                    "name": "Private DNS Zone CNAME record",
+                    "description": "This module deploys a Private DNS Zone CNAME record.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                            }
+                          },
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the CNAME record."
+                      }
+                    },
+                    "cnameRecord": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. A CNAME record."
+                      }
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The metadata attached to the record set."
+                      }
+                    },
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
+                      "metadata": {
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "CNAME": {
+                      "type": "Microsoft.Network/privateDnsZones/CNAME",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "cnameRecord": "[parameters('cnameRecord')]",
+                        "metadata": "[parameters('metadata')]",
+                        "ttl": "[parameters('ttl')]"
+                      }
+                    },
+                    "CNAME_roleAssignments": {
+                      "copy": {
+                        "name": "CNAME_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/CNAME/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "CNAME"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed CNAME record."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed CNAME record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed CNAME record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_MX": {
+              "copy": {
+                "name": "privateDnsZone_MX",
+                "count": "[length(coalesce(parameters('mx'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-MXRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('mx'), createArray())[copyIndex()].name]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "mxRecords": {
+                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'mxRecords')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.32.4.45862",
+                      "templateHash": "2520323624213076361"
+                    },
+                    "name": "Private DNS Zone MX record",
+                    "description": "This module deploys a Private DNS Zone MX record.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                            }
+                          },
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the MX record."
+                      }
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The metadata attached to the record set."
+                      }
+                    },
+                    "mxRecords": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The list of MX records in the record set."
+                      }
+                    },
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
+                      "metadata": {
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "MX": {
+                      "type": "Microsoft.Network/privateDnsZones/MX",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "metadata": "[parameters('metadata')]",
+                        "mxRecords": "[parameters('mxRecords')]",
+                        "ttl": "[parameters('ttl')]"
+                      }
+                    },
+                    "MX_roleAssignments": {
+                      "copy": {
+                        "name": "MX_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/MX/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "MX"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed MX record."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed MX record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed MX record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_PTR": {
+              "copy": {
+                "name": "privateDnsZone_PTR",
+                "count": "[length(coalesce(parameters('ptr'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-PTRRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('ptr'), createArray())[copyIndex()].name]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "ptrRecords": {
+                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'ptrRecords')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.32.4.45862",
+                      "templateHash": "3080404733048745471"
+                    },
+                    "name": "Private DNS Zone PTR record",
+                    "description": "This module deploys a Private DNS Zone PTR record.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                            }
+                          },
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the PTR record."
+                      }
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The metadata attached to the record set."
+                      }
+                    },
+                    "ptrRecords": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The list of PTR records in the record set."
+                      }
+                    },
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
+                      "metadata": {
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "PTR": {
+                      "type": "Microsoft.Network/privateDnsZones/PTR",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "metadata": "[parameters('metadata')]",
+                        "ptrRecords": "[parameters('ptrRecords')]",
+                        "ttl": "[parameters('ttl')]"
+                      }
+                    },
+                    "PTR_roleAssignments": {
+                      "copy": {
+                        "name": "PTR_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/PTR/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "PTR"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed PTR record."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed PTR record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed PTR record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_SOA": {
+              "copy": {
+                "name": "privateDnsZone_SOA",
+                "count": "[length(coalesce(parameters('soa'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-SOARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('soa'), createArray())[copyIndex()].name]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "soaRecord": {
+                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'soaRecord')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.32.4.45862",
+                      "templateHash": "6653951445614700931"
+                    },
+                    "name": "Private DNS Zone SOA record",
+                    "description": "This module deploys a Private DNS Zone SOA record.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                            }
+                          },
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the SOA record."
+                      }
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The metadata attached to the record set."
+                      }
+                    },
+                    "soaRecord": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. A SOA record."
+                      }
+                    },
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
+                      "metadata": {
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "SOA": {
+                      "type": "Microsoft.Network/privateDnsZones/SOA",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "metadata": "[parameters('metadata')]",
+                        "soaRecord": "[parameters('soaRecord')]",
+                        "ttl": "[parameters('ttl')]"
+                      }
+                    },
+                    "SOA_roleAssignments": {
+                      "copy": {
+                        "name": "SOA_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/SOA/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "SOA"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed SOA record."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed SOA record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed SOA record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_SRV": {
+              "copy": {
+                "name": "privateDnsZone_SRV",
+                "count": "[length(coalesce(parameters('srv'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-SRVRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('srv'), createArray())[copyIndex()].name]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "srvRecords": {
+                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'srvRecords')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.32.4.45862",
+                      "templateHash": "5790774778713328446"
+                    },
+                    "name": "Private DNS Zone SRV record",
+                    "description": "This module deploys a Private DNS Zone SRV record.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                            }
+                          },
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the SRV record."
+                      }
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The metadata attached to the record set."
+                      }
+                    },
+                    "srvRecords": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The list of SRV records in the record set."
+                      }
+                    },
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
+                      "metadata": {
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "SRV": {
+                      "type": "Microsoft.Network/privateDnsZones/SRV",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "metadata": "[parameters('metadata')]",
+                        "srvRecords": "[parameters('srvRecords')]",
+                        "ttl": "[parameters('ttl')]"
+                      }
+                    },
+                    "SRV_roleAssignments": {
+                      "copy": {
+                        "name": "SRV_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/SRV/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "SRV"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed SRV record."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed SRV record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed SRV record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_TXT": {
+              "copy": {
+                "name": "privateDnsZone_TXT",
+                "count": "[length(coalesce(parameters('txt'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-TXTRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('txt'), createArray())[copyIndex()].name]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "txtRecords": {
+                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'txtRecords')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.32.4.45862",
+                      "templateHash": "1855369119498044639"
+                    },
+                    "name": "Private DNS Zone TXT record",
+                    "description": "This module deploys a Private DNS Zone TXT record.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                            }
+                          },
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the TXT record."
+                      }
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The metadata attached to the record set."
+                      }
+                    },
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
+                      "metadata": {
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "txtRecords": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The list of TXT records in the record set."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "TXT": {
+                      "type": "Microsoft.Network/privateDnsZones/TXT",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "metadata": "[parameters('metadata')]",
+                        "ttl": "[parameters('ttl')]",
+                        "txtRecords": "[parameters('txtRecords')]"
+                      }
+                    },
+                    "TXT_roleAssignments": {
+                      "copy": {
+                        "name": "TXT_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/TXT/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "TXT"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed TXT record."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed TXT record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed TXT record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_virtualNetworkLinks": {
+              "copy": {
+                "name": "privateDnsZone_virtualNetworkLinks",
+                "count": "[length(coalesce(parameters('virtualNetworkLinks'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-VirtualNetworkLink-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'name'), format('{0}-vnetlink', last(split(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()].virtualNetworkResourceId, '/'))))]"
+                  },
+                  "virtualNetworkResourceId": {
+                    "value": "[coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()].virtualNetworkResourceId]"
+                  },
+                  "location": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'location'), 'global')]"
+                  },
+                  "registrationEnabled": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'registrationEnabled'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                  },
+                  "resolutionPolicy": {
+                    "value": "[tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'resolutionPolicy')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.32.4.45862",
+                      "templateHash": "15326596012552051215"
+                    },
+                    "name": "Private DNS Zone Virtual Network Link",
+                    "description": "This module deploys a Private DNS Zone Virtual Network Link.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('{0}-vnetlink', last(split(parameters('virtualNetworkResourceId'), '/')))]",
+                      "metadata": {
+                        "description": "Optional. The name of the virtual network link."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "global",
+                      "metadata": {
+                        "description": "Optional. The location of the PrivateDNSZone. Should be global."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "registrationEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Is auto-registration of virtual machine records in the virtual network in the Private DNS zone enabled?."
+                      }
+                    },
+                    "virtualNetworkResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Link to another virtual network resource ID."
+                      }
+                    },
+                    "resolutionPolicy": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resolution policy on the virtual network link. Only applicable for virtual network links to privatelink zones, and for A,AAAA,CNAME queries. When set to `NxDomainRedirect`, Azure DNS resolver falls back to public resolution if private dns query resolution results in non-existent domain response. `Default` is configured as the default option."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "virtualNetworkLink": {
+                      "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
+                      "apiVersion": "2024-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "registrationEnabled": "[parameters('registrationEnabled')]",
+                        "virtualNetwork": {
+                          "id": "[parameters('virtualNetworkResourceId')]"
+                        },
+                        "resolutionPolicy": "[parameters('resolutionPolicy')]"
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed virtual network link."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed virtual network link."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/virtualNetworkLinks', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed virtual network link."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('virtualNetworkLink', '2024-06-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            }
+          },
+          "outputs": {
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group the private DNS zone was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the private DNS zone."
+              },
+              "value": "[parameters('name')]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the private DNS zone."
+              },
+              "value": "[resourceId('Microsoft.Network/privateDnsZones', parameters('name'))]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('privateDnsZone', '2020-06-01', 'full').location]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "virtualNetwork"
+      ]
+    },
+    "cosmosDb": {
+      "condition": "[variables('cosmosDbAccountEnabled')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('avm.res.document-db.database-account.{0}', variables('cosmosDbResourceName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[coalesce(tryGet(parameters('cosmosDbAccountConfiguration'), 'name'), format('cosmos-{0}', parameters('solutionPrefix')))]"
+          },
+          "location": {
+            "value": "[coalesce(tryGet(parameters('cosmosDbAccountConfiguration'), 'location'), parameters('solutionLocation'))]"
+          },
+          "tags": {
+            "value": "[coalesce(tryGet(parameters('cosmosDbAccountConfiguration'), 'tags'), parameters('tags'))]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "diagnosticSettings": {
+            "value": [
+              {
+                "workspaceResourceId": "[if(variables('useExistingWorkspace'), variables('existingWorkspaceResourceId'), listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId)]"
+              }
+            ]
+          },
+          "databaseAccountOfferType": {
+            "value": "Standard"
+          },
+          "enableFreeTier": {
+            "value": false
+          },
+          "networkRestrictions": {
+            "value": {
+              "networkAclBypass": "None",
+              "publicNetworkAccess": "[if(variables('virtualNetworkEnabled'), 'Disabled', 'Enabled')]"
+            }
+          },
+          "privateEndpoints": "[if(variables('virtualNetworkEnabled'), createObject('value', createArray(createObject('name', format('pep-{0}', variables('cosmosDbResourceName')), 'customNetworkInterfaceName', format('nic-{0}', variables('cosmosDbResourceName')), 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', reference('privateDnsZonesCosmosDb').outputs.resourceId.value))), 'service', 'Sql', 'subnetResourceId', coalesce(tryGet(parameters('cosmosDbAccountConfiguration'), 'subnetResourceId'), reference('virtualNetwork').outputs.subnetResourceIds.value[0])))), createObject('value', createArray()))]",
+          "sqlDatabases": {
+            "value": "[concat(coalesce(tryGet(parameters('cosmosDbAccountConfiguration'), 'sqlDatabases'), createArray()), createArray(createObject('name', variables('cosmosDbDatabaseName'), 'containers', createArray(createObject('name', variables('cosmosDbDatabaseMemoryContainerName'), 'paths', createArray('/session_id'), 'kind', 'Hash', 'version', 2)))))]"
+          },
+          "locations": {
+            "value": [
+              {
+                "locationName": "[coalesce(tryGet(parameters('cosmosDbAccountConfiguration'), 'location'), parameters('solutionLocation'))]",
+                "failoverPriority": 0,
+                "isZoneRedundant": false
+              }
+            ]
+          },
+          "capabilitiesToAdd": {
+            "value": [
+              "EnableServerless"
+            ]
+          },
+          "sqlRoleAssignmentsPrincipalIds": {
+            "value": [
+              "[tryGet(tryGet(reference('containerApp').outputs, 'systemAssignedMIPrincipalId'), 'value')]"
+            ]
+          },
+          "sqlRoleDefinitions": {
+            "value": [
+              {
+                "roleType": "CustomRole",
+                "roleName": "Cosmos DB SQL Data Contributor",
+                "name": "cosmos-db-sql-data-contributor",
+                "dataAction": [
+                  "Microsoft.DocumentDB/databaseAccounts/readMetadata",
+                  "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/*",
+                  "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/*"
+                ]
+              }
+            ]
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.34.44.8038",
+              "templateHash": "4234855794516527664"
+            },
+            "name": "DocumentDB Database Accounts",
+            "description": "This module deploys a DocumentDB Database Account."
+          },
+          "definitions": {
+            "privateEndpointOutputType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "The name of the private endpoint."
+                  }
+                },
+                "resourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "The resource ID of the private endpoint."
+                  }
+                },
+                "groupId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "The group Id for the private endpoint Group."
+                  }
+                },
+                "customDnsConfigs": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "fqdn": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "FQDN that resolves to private endpoint IP address."
+                        }
+                      },
+                      "ipAddresses": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
+                        "metadata": {
+                          "description": "A list of private IP addresses of the private endpoint."
+                        }
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "The custom DNS configurations of the private endpoint."
+                  }
+                },
+                "networkInterfaceResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "metadata": {
+                    "description": "The IDs of the network interfaces associated with the private endpoint."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for the private endpoint output."
+              }
+            },
+            "failoverLocationType": {
+              "type": "object",
+              "properties": {
+                "failoverPriority": {
+                  "type": "int",
+                  "metadata": {
+                    "description": "Required. The failover priority of the region. A failover priority of 0 indicates a write region. The maximum value for a failover priority = (total number of regions - 1). Failover priority values must be unique for each of the regions in which the database account exists."
+                  }
+                },
+                "isZoneRedundant": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Default to true. Flag to indicate whether or not this region is an AvailabilityZone region."
+                  }
+                },
+                "locationName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the region."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for the failover location."
+              }
+            },
+            "sqlRoleDefinitionType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Name of the SQL Role Definition."
+                  }
+                },
+                "dataAction": {
+                  "type": "array",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. An array of data actions that are allowed."
+                  }
+                },
+                "roleName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A user-friendly name for the Role Definition. Must be unique for the database account."
+                  }
+                },
+                "roleType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "BuiltInRole",
+                    "CustomRole"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Indicates whether the Role Definition was built-in or user created."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for the SQL Role Definitions."
+              }
+            },
+            "sqlDatabaseType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Name of the SQL database ."
+                  }
+                },
+                "throughput": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Default to 400. Request units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                  }
+                },
+                "autoscaleSettingsMaxThroughput": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                  }
+                },
+                "containers": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "name": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. Name of the container."
+                        }
+                      },
+                      "paths": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
+                        "minLength": 1,
+                        "maxLength": 3,
+                        "metadata": {
+                          "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1."
+                        }
+                      },
+                      "analyticalStorageTtl": {
+                        "type": "int",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store."
+                        }
+                      },
+                      "autoscaleSettingsMaxThroughput": {
+                        "type": "int",
+                        "nullable": true,
+                        "maxValue": 1000000,
+                        "metadata": {
+                          "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level."
+                        }
+                      },
+                      "conflictResolutionPolicy": {
+                        "type": "object",
+                        "properties": {
+                          "conflictResolutionPath": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Conditional. The conflict resolution path in the case of LastWriterWins mode. Required if `mode` is set to 'LastWriterWins'."
+                            }
+                          },
+                          "conflictResolutionProcedure": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Conditional. The procedure to resolve conflicts in the case of custom mode. Required if `mode` is set to 'Custom'."
+                            }
+                          },
+                          "mode": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Custom",
+                              "LastWriterWins"
+                            ],
+                            "metadata": {
+                              "description": "Required. Indicates the conflict resolution mode."
+                            }
+                          }
+                        },
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions."
+                        }
+                      },
+                      "defaultTtl": {
+                        "type": "int",
+                        "nullable": true,
+                        "minValue": -1,
+                        "maxValue": 2147483647,
+                        "metadata": {
+                          "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default."
+                        }
+                      },
+                      "indexingPolicy": {
+                        "type": "object",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Indexing policy of the container."
+                        }
+                      },
+                      "kind": {
+                        "type": "string",
+                        "allowedValues": [
+                          "Hash",
+                          "MultiHash"
+                        ],
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning."
+                        }
+                      },
+                      "version": {
+                        "type": "int",
+                        "allowedValues": [
+                          1,
+                          2
+                        ],
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition."
+                        }
+                      },
+                      "throughput": {
+                        "type": "int",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used."
+                        }
+                      },
+                      "uniqueKeyPolicyKeys": {
+                        "type": "array",
+                        "items": {
+                          "type": "object",
+                          "properties": {
+                            "paths": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "metadata": {
+                                "description": "Required. List of paths must be unique for each document in the Azure Cosmos DB service."
+                              }
+                            }
+                          }
+                        },
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Array of containers to deploy in the SQL database."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for the SQL database."
+              }
+            },
+            "secretsExportConfigurationType": {
+              "type": "object",
+              "properties": {
+                "keyVaultResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource ID of the key vault where to store the secrets of this module."
+                  }
+                },
+                "primaryWriteKeySecretName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The primary write key secret name to create."
+                  }
+                },
+                "primaryReadOnlyKeySecretName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The primary readonly key secret name to create."
+                  }
+                },
+                "primaryWriteConnectionStringSecretName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The primary write connection string secret name to create."
+                  }
+                },
+                "primaryReadonlyConnectionStringSecretName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The primary readonly connection string secret name to create."
+                  }
+                },
+                "secondaryWriteKeySecretName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The primary write key secret name to create."
+                  }
+                },
+                "secondaryReadonlyKeySecretName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The primary readonly key secret name to create."
+                  }
+                },
+                "secondaryWriteConnectionStringSecretName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The primary write connection string secret name to create."
+                  }
+                },
+                "secondaryReadonlyConnectionStringSecretName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The primary readonly connection string secret name to create."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for the secrets export configuration."
+              }
+            },
+            "secretsOutputType": {
+              "type": "object",
+              "properties": {},
+              "additionalProperties": {
+                "$ref": "#/definitions/secretSetType",
+                "metadata": {
+                  "description": "An exported secret's references."
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for the secrets output."
+              }
+            },
+            "networkRestrictionType": {
+              "type": "object",
+              "properties": {
+                "ipRules": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A single IPv4 address or a single IPv4 address range in CIDR format. Provided IPs must be well-formatted and cannot be contained in one of the following ranges: 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, since these are not enforceable by the IP address filter. Example of valid inputs: \"23.40.210.245\" or \"23.40.210.0/8\"."
+                  }
+                },
+                "networkAclBypass": {
+                  "type": "string",
+                  "allowedValues": [
+                    "AzureServices",
+                    "None"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Default to None. Specifies the network ACL bypass for Azure services."
+                  }
+                },
+                "publicNetworkAccess": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Disabled",
+                    "Enabled"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Default to Disabled. Whether requests from Public Network are allowed."
+                  }
+                },
+                "virtualNetworkRules": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "subnetResourceId": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. Resource ID of a subnet."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. List of Virtual Network ACL rules configured for the Cosmos DB account.."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for the network restriction."
+              }
+            },
+            "_1.privateEndpointCustomDnsConfigType": {
+              "type": "object",
+              "properties": {
+                "fqdn": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                  }
+                },
+                "ipAddresses": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "metadata": {
+                    "description": "Required. A list of private IP addresses of the private endpoint."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointIpConfigurationType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the resource that is unique within a resource group."
+                  }
+                },
+                "properties": {
+                  "type": "object",
+                  "properties": {
+                    "groupId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                      }
+                    },
+                    "memberName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                      }
+                    },
+                    "privateIPAddress": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. Properties of private endpoint IP configurations."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointPrivateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "name": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The name of the private DNS Zone Group config."
+                        }
+                      },
+                      "privateDnsZoneResourceId": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The resource id of the private DNS zone."
+                        }
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "diagnosticSettingFullType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the diagnostic setting."
+                  }
+                },
+                "logCategoriesAndGroups": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "category": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                        }
+                      },
+                      "categoryGroup": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                        }
+                      },
+                      "enabled": {
+                        "type": "bool",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                  }
+                },
+                "metricCategories": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "category": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                        }
+                      },
+                      "enabled": {
+                        "type": "bool",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                  }
+                },
+                "logAnalyticsDestinationType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "AzureDiagnostics",
+                    "Dedicated"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                  }
+                },
+                "workspaceResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "storageAccountResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "eventHubAuthorizationRuleResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                  }
+                },
+                "eventHubName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "marketplacePartnerResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a lock.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "managedIdentityAllType": {
+              "type": "object",
+              "properties": {
+                "systemAssigned": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enables system assigned managed identity on the resource."
+                  }
+                },
+                "userAssignedResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "privateEndpointMultiServiceType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private endpoint."
+                  }
+                },
+                "location": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The location to deploy the private endpoint to."
+                  }
+                },
+                "privateLinkServiceConnectionName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private link connection to create."
+                  }
+                },
+                "service": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\" for a Storage Account's Private Endpoints."
+                  }
+                },
+                "subnetResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                  }
+                },
+                "resourceGroupResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                  }
+                },
+                "privateDnsZoneGroup": {
+                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                  }
+                },
+                "isManualConnection": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. If Manual Private Link Connection is required."
+                  }
+                },
+                "manualConnectionRequestMessage": {
+                  "type": "string",
+                  "nullable": true,
+                  "maxLength": 140,
+                  "metadata": {
+                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                  }
+                },
+                "customDnsConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Custom DNS configurations."
+                  }
+                },
+                "ipConfigurations": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                  }
+                },
+                "applicationSecurityGroupResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                  }
+                },
+                "customNetworkInterfaceName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                  }
+                },
+                "lock": {
+                  "$ref": "#/definitions/lockType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                },
+                "roleAssignments": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/roleAssignmentType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Array of role assignments to create."
+                  }
+                },
+                "tags": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                  }
+                },
+                "enableTelemetry": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enable/Disable usage telemetry for module."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can NOT be assumed (i.e., for services that have more than one subresource, like Storage Account with Blob (blob, table, queue, file, ...).",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "roleAssignmentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                  }
+                },
+                "roleDefinitionIdOrName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                  }
+                },
+                "principalId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                  }
+                },
+                "principalType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Device",
+                    "ForeignGroup",
+                    "Group",
+                    "ServicePrincipal",
+                    "User"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The principal type of the assigned principal ID."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The description of the role assignment."
+                  }
+                },
+                "condition": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                  }
+                },
+                "conditionVersion": {
+                  "type": "string",
+                  "allowedValues": [
+                    "2.0"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Version of the condition."
+                  }
+                },
+                "delegatedManagedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a role assignment.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "secretSetType": {
+              "type": "object",
+              "properties": {
+                "secretResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "The resourceId of the exported secret."
+                  }
+                },
+                "secretUri": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "The secret URI of the exported secret."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "The type for the secret set.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "modules/keyVaultExport.bicep"
+                }
+              }
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name of the Database Account."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Default to current resource group scope location. Location for all resources."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the Database Account resource."
+              }
+            },
+            "managedIdentities": {
+              "$ref": "#/definitions/managedIdentityAllType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The managed identity definition for this resource."
+              }
+            },
+            "databaseAccountOfferType": {
+              "type": "string",
+              "defaultValue": "Standard",
+              "allowedValues": [
+                "Standard"
+              ],
+              "metadata": {
+                "description": "Optional. Default to Standard. The offer type for the Azure Cosmos DB database account."
+              }
+            },
+            "locations": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/failoverLocationType"
+              },
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. Default to the location where the account is deployed. Locations enabled for the Cosmos DB account."
+              }
+            },
+            "defaultConsistencyLevel": {
+              "type": "string",
+              "defaultValue": "Session",
+              "allowedValues": [
+                "Eventual",
+                "ConsistentPrefix",
+                "Session",
+                "BoundedStaleness",
+                "Strong"
+              ],
+              "metadata": {
+                "description": "Optional. Default to Session. The default consistency level of the Cosmos DB account."
+              }
+            },
+            "disableLocalAuth": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Default to true. Opt-out of local authentication and ensure only MSI and AAD can be used exclusively for authentication."
+              }
+            },
+            "enableAnalyticalStorage": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Default to false. Flag to indicate whether to enable storage analytics."
+              }
+            },
+            "automaticFailover": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Default to true. Enable automatic failover for regions."
+              }
+            },
+            "enableFreeTier": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Default to false. Flag to indicate whether Free Tier is enabled."
+              }
+            },
+            "enableMultipleWriteLocations": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Default to false. Enables the account to write in multiple locations. Periodic backup must be used if enabled."
+              }
+            },
+            "disableKeyBasedMetadataWriteAccess": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Default to true. Disable write operations on metadata resources (databases, containers, throughput) via account keys."
+              }
+            },
+            "maxStalenessPrefix": {
+              "type": "int",
+              "defaultValue": 100000,
+              "minValue": 1,
+              "maxValue": 2147483647,
+              "metadata": {
+                "description": "Optional. Default to 100000. Max stale requests. Required for BoundedStaleness. Valid ranges, Single Region: 10 to 1000000. Multi Region: 100000 to 1000000."
+              }
+            },
+            "maxIntervalInSeconds": {
+              "type": "int",
+              "defaultValue": 300,
+              "minValue": 5,
+              "maxValue": 86400,
+              "metadata": {
+                "description": "Optional. Default to 300. Max lag time (minutes). Required for BoundedStaleness. Valid ranges, Single Region: 5 to 84600. Multi Region: 300 to 86400."
+              }
+            },
+            "serverVersion": {
+              "type": "string",
+              "defaultValue": "4.2",
+              "allowedValues": [
+                "3.2",
+                "3.6",
+                "4.0",
+                "4.2",
+                "5.0",
+                "6.0",
+                "7.0"
+              ],
+              "metadata": {
+                "description": "Optional. Default to 4.2. Specifies the MongoDB server version to use."
+              }
+            },
+            "sqlDatabases": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/sqlDatabaseType"
+              },
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. SQL Databases configurations."
+              }
+            },
+            "sqlRoleAssignmentsPrincipalIds": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. SQL Role Definitions configurations."
+              }
+            },
+            "sqlRoleDefinitions": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/sqlRoleDefinitionType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. SQL Role Definitions configurations."
+              }
+            },
+            "mongodbDatabases": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. MongoDB Databases configurations."
+              }
+            },
+            "gremlinDatabases": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. Gremlin Databases configurations."
+              }
+            },
+            "tables": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. Table configurations."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "totalThroughputLimit": {
+              "type": "int",
+              "defaultValue": -1,
+              "metadata": {
+                "description": "Optional. Default to unlimited. The total throughput limit imposed on this Cosmos DB account (RU/s)."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "roleAssignments": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/roleAssignmentType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "diagnosticSettings": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/diagnosticSettingFullType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The diagnostic settings of the service."
+              }
+            },
+            "capabilitiesToAdd": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "defaultValue": [],
+              "allowedValues": [
+                "EnableCassandra",
+                "EnableTable",
+                "EnableGremlin",
+                "EnableMongo",
+                "DisableRateLimitingResponses",
+                "EnableServerless",
+                "EnableNoSQLVectorSearch",
+                "EnableNoSQLFullTextSearch",
+                "EnableMaterializedViews",
+                "DeleteAllItemsByPartitionKey"
+              ],
+              "metadata": {
+                "description": "Optional. List of Cosmos DB capabilities for the account. THE DeleteAllItemsByPartitionKey VALUE USED IN THIS PARAMETER IS USED FOR A PREVIEW SERVICE/FEATURE, MICROSOFT MAY NOT PROVIDE SUPPORT FOR THIS, PLEASE CHECK THE PRODUCT DOCS FOR CLARIFICATION."
+              }
+            },
+            "backupPolicyType": {
+              "type": "string",
+              "defaultValue": "Continuous",
+              "allowedValues": [
+                "Periodic",
+                "Continuous"
+              ],
+              "metadata": {
+                "description": "Optional. Default to Continuous. Describes the mode of backups. Periodic backup must be used if multiple write locations are used."
+              }
+            },
+            "backupPolicyContinuousTier": {
+              "type": "string",
+              "defaultValue": "Continuous30Days",
+              "allowedValues": [
+                "Continuous30Days",
+                "Continuous7Days"
+              ],
+              "metadata": {
+                "description": "Optional. Default to Continuous30Days. Configuration values for continuous mode backup."
+              }
+            },
+            "backupIntervalInMinutes": {
+              "type": "int",
+              "defaultValue": 240,
+              "minValue": 60,
+              "maxValue": 1440,
+              "metadata": {
+                "description": "Optional. Default to 240. An integer representing the interval in minutes between two backups. Only applies to periodic backup type."
+              }
+            },
+            "backupRetentionIntervalInHours": {
+              "type": "int",
+              "defaultValue": 8,
+              "minValue": 2,
+              "maxValue": 720,
+              "metadata": {
+                "description": "Optional. Default to 8. An integer representing the time (in hours) that each backup is retained. Only applies to periodic backup type."
+              }
+            },
+            "backupStorageRedundancy": {
+              "type": "string",
+              "defaultValue": "Local",
+              "allowedValues": [
+                "Geo",
+                "Local",
+                "Zone"
+              ],
+              "metadata": {
+                "description": "Optional. Default to Local. Enum to indicate type of backup residency. Only applies to periodic backup type."
+              }
+            },
+            "privateEndpoints": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/privateEndpointMultiServiceType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+              }
+            },
+            "secretsExportConfiguration": {
+              "$ref": "#/definitions/secretsExportConfigurationType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Key vault reference and secret settings for the module's secrets export."
+              }
+            },
+            "networkRestrictions": {
+              "$ref": "#/definitions/networkRestrictionType",
+              "defaultValue": {
+                "ipRules": [],
+                "virtualNetworkRules": [],
+                "publicNetworkAccess": "Disabled"
+              },
+              "metadata": {
+                "description": "Optional. The network configuration of this module. Defaults to `{ ipRules: [], virtualNetworkRules: [], publicNetworkAccess: 'Disabled' }`."
+              }
+            },
+            "minimumTlsVersion": {
+              "type": "string",
+              "defaultValue": "Tls12",
+              "allowedValues": [
+                "Tls12"
+              ],
+              "metadata": {
+                "description": "Optional. Default to TLS 1.2. Enum to indicate the minimum allowed TLS version. Azure Cosmos DB for MongoDB RU and Apache Cassandra only work with TLS 1.2 or later."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "databaseAccount_locations",
+                "count": "[length(parameters('locations'))]",
+                "input": {
+                  "failoverPriority": "[parameters('locations')[copyIndex('databaseAccount_locations')].failoverPriority]",
+                  "locationName": "[parameters('locations')[copyIndex('databaseAccount_locations')].locationName]",
+                  "isZoneRedundant": "[coalesce(tryGet(parameters('locations')[copyIndex('databaseAccount_locations')], 'isZoneRedundant'), true())]"
+                }
+              },
+              {
+                "name": "capabilities",
+                "count": "[length(parameters('capabilitiesToAdd'))]",
+                "input": {
+                  "name": "[parameters('capabilitiesToAdd')[copyIndex('capabilities')]]"
+                }
+              },
+              {
+                "name": "ipRules",
+                "count": "[length(coalesce(tryGet(parameters('networkRestrictions'), 'ipRules'), createArray()))]",
+                "input": {
+                  "ipAddressOrRange": "[coalesce(tryGet(parameters('networkRestrictions'), 'ipRules'), createArray())[copyIndex('ipRules')]]"
+                }
+              },
+              {
+                "name": "virtualNetworkRules",
+                "count": "[length(coalesce(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules'), createArray()))]",
+                "input": {
+                  "id": "[coalesce(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules'), createArray())[copyIndex('virtualNetworkRules')].subnetResourceId]",
+                  "ignoreMissingVnetServiceEndpoint": false
+                }
+              },
+              {
+                "name": "formattedRoleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+              }
+            ],
+            "enableReferencedModulesTelemetry": false,
+            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+            "consistencyPolicy": {
+              "Eventual": {
+                "defaultConsistencyLevel": "Eventual"
+              },
+              "ConsistentPrefix": {
+                "defaultConsistencyLevel": "ConsistentPrefix"
+              },
+              "Session": {
+                "defaultConsistencyLevel": "Session"
+              },
+              "BoundedStaleness": {
+                "defaultConsistencyLevel": "BoundedStaleness",
+                "maxStalenessPrefix": "[parameters('maxStalenessPrefix')]",
+                "maxIntervalInSeconds": "[parameters('maxIntervalInSeconds')]"
+              },
+              "Strong": {
+                "defaultConsistencyLevel": "Strong"
+              }
+            },
+            "defaultFailoverLocation": [
+              {
+                "failoverPriority": 0,
+                "locationName": "[parameters('location')]",
+                "isZoneRedundant": true
+              }
+            ],
+            "kind": "[if(or(not(empty(parameters('sqlDatabases'))), not(empty(parameters('gremlinDatabases')))), 'GlobalDocumentDB', if(not(empty(parameters('mongodbDatabases'))), 'MongoDB', 'GlobalDocumentDB'))]",
+            "backupPolicy": "[if(equals(parameters('backupPolicyType'), 'Continuous'), createObject('type', parameters('backupPolicyType'), 'continuousModeProperties', createObject('tier', parameters('backupPolicyContinuousTier'))), createObject('type', parameters('backupPolicyType'), 'periodicModeProperties', createObject('backupIntervalInMinutes', parameters('backupIntervalInMinutes'), 'backupRetentionIntervalInHours', parameters('backupRetentionIntervalInHours'), 'backupStorageRedundancy', parameters('backupStorageRedundancy'))))]",
+            "databaseAccountProperties": "[union(createObject('databaseAccountOfferType', parameters('databaseAccountOfferType'), 'backupPolicy', variables('backupPolicy'), 'capabilities', variables('capabilities'), 'minimalTlsVersion', parameters('minimumTlsVersion'), 'capacity', createObject('totalThroughputLimit', parameters('totalThroughputLimit'))), if(or(or(or(not(empty(parameters('sqlDatabases'))), not(empty(parameters('mongodbDatabases')))), not(empty(parameters('gremlinDatabases')))), not(empty(parameters('tables')))), createObject('consistencyPolicy', variables('consistencyPolicy')[parameters('defaultConsistencyLevel')], 'enableMultipleWriteLocations', parameters('enableMultipleWriteLocations'), 'locations', if(empty(variables('databaseAccount_locations')), variables('defaultFailoverLocation'), variables('databaseAccount_locations')), 'ipRules', variables('ipRules'), 'virtualNetworkRules', variables('virtualNetworkRules'), 'networkAclBypass', coalesce(tryGet(parameters('networkRestrictions'), 'networkAclBypass'), 'None'), 'publicNetworkAccess', coalesce(tryGet(parameters('networkRestrictions'), 'publicNetworkAccess'), 'Disabled'), 'isVirtualNetworkFilterEnabled', or(not(empty(variables('ipRules'))), not(empty(variables('virtualNetworkRules')))), 'enableFreeTier', parameters('enableFreeTier'), 'enableAutomaticFailover', parameters('automaticFailover'), 'enableAnalyticalStorage', parameters('enableAnalyticalStorage')), createObject()), if(or(not(empty(parameters('sqlDatabases'))), not(empty(parameters('tables')))), createObject('disableLocalAuth', parameters('disableLocalAuth'), 'disableKeyBasedMetadataWriteAccess', parameters('disableKeyBasedMetadataWriteAccess')), createObject()), if(not(empty(parameters('mongodbDatabases'))), createObject('apiProperties', createObject('serverVersion', parameters('serverVersion'))), createObject()))]",
+            "builtInRoleNames": {
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Cosmos DB Account Reader Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fbdf93bf-df7d-467e-a4d2-9458aa1360c8')]",
+              "Cosmos DB Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa')]",
+              "CosmosBackupOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db7b14f2-5adf-42da-9f96-f2ee17bab5cb')]",
+              "CosmosRestoreOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5432c526-bc82-444a-b7ba-57c5b0b5b34f')]",
+              "DocumentDB Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5bd9cd88-fe45-4216-938b-f97437e15450')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+            }
+          },
+          "resources": {
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-07-01",
+              "name": "[format('46d3xbcp.res.documentdb-databaseaccount.{0}.{1}', replace('0.12.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "databaseAccount": {
+              "type": "Microsoft.DocumentDB/databaseAccounts",
+              "apiVersion": "2024-11-15",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "identity": "[variables('identity')]",
+              "kind": "[variables('kind')]",
+              "properties": "[variables('databaseAccountProperties')]"
+            },
+            "databaseAccount_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "databaseAccount"
+              ]
+            },
+            "databaseAccount_diagnosticSettings": {
+              "copy": {
+                "name": "databaseAccount_diagnosticSettings",
+                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+              },
+              "type": "Microsoft.Insights/diagnosticSettings",
+              "apiVersion": "2021-05-01-preview",
+              "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "metrics",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                    "input": {
+                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                      "timeGrain": null
+                    }
+                  },
+                  {
+                    "name": "logs",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                    "input": {
+                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                    }
+                  }
+                ],
+                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+              },
+              "dependsOn": [
+                "databaseAccount"
+              ]
+            },
+            "databaseAccount_roleAssignments": {
+              "copy": {
+                "name": "databaseAccount_roleAssignments",
+                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+              "properties": {
+                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "databaseAccount"
+              ]
+            },
+            "databaseAccount_sqlDatabases": {
+              "copy": {
+                "name": "databaseAccount_sqlDatabases",
+                "count": "[length(parameters('sqlDatabases'))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('location')), parameters('sqlDatabases')[copyIndex()].name)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('sqlDatabases')[copyIndex()].name]"
+                  },
+                  "containers": {
+                    "value": "[tryGet(parameters('sqlDatabases')[copyIndex()], 'containers')]"
+                  },
+                  "throughput": {
+                    "value": "[tryGet(parameters('sqlDatabases')[copyIndex()], 'throughput')]"
+                  },
+                  "databaseAccountName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "autoscaleSettingsMaxThroughput": {
+                    "value": "[tryGet(parameters('sqlDatabases')[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "16080632612286518435"
+                    },
+                    "name": "DocumentDB Database Account SQL Databases",
+                    "description": "This module deploys a SQL Database in a CosmosDB Account."
+                  },
+                  "parameters": {
+                    "databaseAccountName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the SQL database ."
+                      }
+                    },
+                    "containers": {
+                      "type": "array",
+                      "items": {
+                        "type": "object"
+                      },
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Array of containers to deploy in the SQL database."
+                      }
+                    },
+                    "throughput": {
+                      "type": "int",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Request units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                      }
+                    },
+                    "autoscaleSettingsMaxThroughput": {
+                      "type": "int",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the SQL database resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "databaseAccount": {
+                      "existing": true,
+                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                      "apiVersion": "2024-11-15",
+                      "name": "[parameters('databaseAccountName')]"
+                    },
+                    "sqlDatabase": {
+                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases",
+                      "apiVersion": "2024-11-15",
+                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "resource": {
+                          "id": "[parameters('name')]"
+                        },
+                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(equals(parameters('autoscaleSettingsMaxThroughput'), null()), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]"
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    },
+                    "container": {
+                      "copy": {
+                        "name": "container",
+                        "count": "[length(parameters('containers'))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('name')), parameters('containers')[copyIndex()].name)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "databaseAccountName": {
+                            "value": "[parameters('databaseAccountName')]"
+                          },
+                          "sqlDatabaseName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[parameters('containers')[copyIndex()].name]"
+                          },
+                          "analyticalStorageTtl": {
+                            "value": "[tryGet(parameters('containers')[copyIndex()], 'analyticalStorageTtl')]"
+                          },
+                          "autoscaleSettingsMaxThroughput": {
+                            "value": "[tryGet(parameters('containers')[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
+                          },
+                          "conflictResolutionPolicy": {
+                            "value": "[tryGet(parameters('containers')[copyIndex()], 'conflictResolutionPolicy')]"
+                          },
+                          "defaultTtl": {
+                            "value": "[tryGet(parameters('containers')[copyIndex()], 'defaultTtl')]"
+                          },
+                          "indexingPolicy": {
+                            "value": "[tryGet(parameters('containers')[copyIndex()], 'indexingPolicy')]"
+                          },
+                          "kind": {
+                            "value": "[tryGet(parameters('containers')[copyIndex()], 'kind')]"
+                          },
+                          "version": {
+                            "value": "[tryGet(parameters('containers')[copyIndex()], 'version')]"
+                          },
+                          "paths": {
+                            "value": "[tryGet(parameters('containers')[copyIndex()], 'paths')]"
+                          },
+                          "throughput": "[if(and(or(not(equals(parameters('throughput'), null())), not(equals(parameters('autoscaleSettingsMaxThroughput'), null()))), equals(tryGet(parameters('containers')[copyIndex()], 'throughput'), null())), createObject('value', -1), createObject('value', tryGet(parameters('containers')[copyIndex()], 'throughput')))]",
+                          "uniqueKeyPolicyKeys": {
+                            "value": "[tryGet(parameters('containers')[copyIndex()], 'uniqueKeyPolicyKeys')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.34.44.8038",
+                              "templateHash": "8834615293032195419"
+                            },
+                            "name": "DocumentDB Database Account SQL Database Containers",
+                            "description": "This module deploys a SQL Database Container in a CosmosDB Account."
+                          },
+                          "parameters": {
+                            "databaseAccountName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "sqlDatabaseName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent SQL Database. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the container."
+                              }
+                            },
+                            "analyticalStorageTtl": {
+                              "type": "int",
+                              "defaultValue": 0,
+                              "metadata": {
+                                "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store."
+                              }
+                            },
+                            "conflictResolutionPolicy": {
+                              "type": "object",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions."
+                              }
+                            },
+                            "defaultTtl": {
+                              "type": "int",
+                              "defaultValue": -1,
+                              "minValue": -1,
+                              "maxValue": 2147483647,
+                              "metadata": {
+                                "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default."
+                              }
+                            },
+                            "throughput": {
+                              "type": "int",
+                              "defaultValue": 400,
+                              "metadata": {
+                                "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                              }
+                            },
+                            "autoscaleSettingsMaxThroughput": {
+                              "type": "int",
+                              "nullable": true,
+                              "maxValue": 1000000,
+                              "metadata": {
+                                "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the SQL Database resource."
+                              }
+                            },
+                            "paths": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "minLength": 1,
+                              "maxLength": 3,
+                              "metadata": {
+                                "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1."
+                              }
+                            },
+                            "indexingPolicy": {
+                              "type": "object",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. Indexing policy of the container."
+                              }
+                            },
+                            "uniqueKeyPolicyKeys": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service."
+                              }
+                            },
+                            "kind": {
+                              "type": "string",
+                              "defaultValue": "Hash",
+                              "allowedValues": [
+                                "Hash",
+                                "MultiHash"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning."
+                              }
+                            },
+                            "version": {
+                              "type": "int",
+                              "defaultValue": 1,
+                              "allowedValues": [
+                                1,
+                                2
+                              ],
+                              "metadata": {
+                                "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "partitionKeyPaths",
+                                "count": "[length(parameters('paths'))]",
+                                "input": "[if(startsWith(parameters('paths')[copyIndex('partitionKeyPaths')], '/'), parameters('paths')[copyIndex('partitionKeyPaths')], format('/{0}', parameters('paths')[copyIndex('partitionKeyPaths')]))]"
+                              }
+                            ],
+                            "containerResourceParams": "[union(createObject('conflictResolutionPolicy', parameters('conflictResolutionPolicy'), 'defaultTtl', parameters('defaultTtl'), 'id', parameters('name'), 'indexingPolicy', if(not(empty(parameters('indexingPolicy'))), parameters('indexingPolicy'), null()), 'partitionKey', createObject('paths', variables('partitionKeyPaths'), 'kind', parameters('kind'), 'version', if(equals(parameters('kind'), 'MultiHash'), 2, parameters('version'))), 'uniqueKeyPolicy', if(not(empty(parameters('uniqueKeyPolicyKeys'))), createObject('uniqueKeys', parameters('uniqueKeyPolicyKeys')), null())), if(not(equals(parameters('analyticalStorageTtl'), 0)), createObject('analyticalStorageTtl', parameters('analyticalStorageTtl')), createObject()))]"
+                          },
+                          "resources": {
+                            "databaseAccount::sqlDatabase": {
+                              "existing": true,
+                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases",
+                              "apiVersion": "2024-11-15",
+                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('sqlDatabaseName'))]"
+                            },
+                            "databaseAccount": {
+                              "existing": true,
+                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                              "apiVersion": "2024-11-15",
+                              "name": "[parameters('databaseAccountName')]"
+                            },
+                            "container": {
+                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers",
+                              "apiVersion": "2024-11-15",
+                              "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "resource": "[variables('containerResourceParams')]",
+                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(and(equals(parameters('autoscaleSettingsMaxThroughput'), null()), not(equals(parameters('throughput'), -1))), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]"
+                              },
+                              "dependsOn": [
+                                "databaseAccount"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the container."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the container."
+                              },
+                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the container was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "sqlDatabase"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the SQL database."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the SQL database."
+                      },
+                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', parameters('databaseAccountName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the SQL database was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "databaseAccount"
+              ]
+            },
+            "databaseAccount_sqlRoleDefinitions": {
+              "copy": {
+                "name": "databaseAccount_sqlRoleDefinitions",
+                "count": "[length(coalesce(parameters('sqlRoleDefinitions'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-sqlrd-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()].name)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()].name]"
+                  },
+                  "databaseAccountName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "dataActions": {
+                    "value": "[tryGet(coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()], 'dataActions')]"
+                  },
+                  "roleName": {
+                    "value": "[tryGet(coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()], 'roleName')]"
+                  },
+                  "roleType": {
+                    "value": "[tryGet(coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()], 'roleType')]"
+                  },
+                  "principalIds": {
+                    "value": "[parameters('sqlRoleAssignmentsPrincipalIds')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "2490416937519336508"
+                    },
+                    "name": "DocumentDB Database Account SQL Role.",
+                    "description": "This module deploys SQL Role Definision and Assignment in a CosmosDB Account."
+                  },
+                  "parameters": {
+                    "databaseAccountName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the SQL Role."
+                      }
+                    },
+                    "dataActions": {
+                      "type": "array",
+                      "defaultValue": [
+                        "Microsoft.DocumentDB/databaseAccounts/readMetadata",
+                        "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/*",
+                        "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/*"
+                      ],
+                      "metadata": {
+                        "description": "Optional. An array of data actions that are allowed."
+                      }
+                    },
+                    "principalIds": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Ids needs to be granted."
+                      }
+                    },
+                    "roleName": {
+                      "type": "string",
+                      "defaultValue": "Reader Writer",
+                      "metadata": {
+                        "description": "Optional. A user-friendly name for the Role Definition. Must be unique for the database account."
+                      }
+                    },
+                    "roleType": {
+                      "type": "string",
+                      "defaultValue": "CustomRole",
+                      "allowedValues": [
+                        "CustomRole",
+                        "BuiltInRole"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Indicates whether the Role Definition was built-in or user created."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('sql-role-definition-{0}', uniqueString(parameters('name')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "databaseAccountName": {
+                            "value": "[parameters('databaseAccountName')]"
+                          },
+                          "dataActions": {
+                            "value": "[parameters('dataActions')]"
+                          },
+                          "roleName": {
+                            "value": "[parameters('roleName')]"
+                          },
+                          "roleType": {
+                            "value": "[parameters('roleType')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.34.44.8038",
+                              "templateHash": "16003674161646405716"
+                            },
+                            "name": "DocumentDB Database Account SQL Role Definitions.",
+                            "description": "This module deploys a SQL Role Definision in a CosmosDB Account."
+                          },
+                          "parameters": {
+                            "databaseAccountName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "dataActions": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. An array of data actions that are allowed."
+                              }
+                            },
+                            "roleName": {
+                              "type": "string",
+                              "defaultValue": "Reader Writer",
+                              "metadata": {
+                                "description": "Optional. A user-friendly name for the Role Definition. Must be unique for the database account."
+                              }
+                            },
+                            "roleType": {
+                              "type": "string",
+                              "defaultValue": "CustomRole",
+                              "allowedValues": [
+                                "CustomRole",
+                                "BuiltInRole"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Indicates whether the Role Definition was built-in or user created."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions",
+                              "apiVersion": "2024-11-15",
+                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role'))]",
+                              "properties": {
+                                "assignableScopes": [
+                                  "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
+                                ],
+                                "permissions": [
+                                  {
+                                    "dataActions": "[parameters('dataActions')]"
+                                  }
+                                ],
+                                "roleName": "[parameters('roleName')]",
+                                "type": "[parameters('roleType')]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the SQL database."
+                              },
+                              "value": "[guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the SQL database."
+                              },
+                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('databaseAccountName'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the SQL database was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    {
+                      "copy": {
+                        "name": "sqlRoleAssignment",
+                        "count": "[length(parameters('principalIds'))]",
+                        "mode": "serial",
+                        "batchSize": 1
+                      },
+                      "condition": "[not(empty(parameters('principalIds')[copyIndex()]))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('sql-role-assign-{0}', uniqueString(parameters('principalIds')[copyIndex()]))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[guid(reference(resourceId('Microsoft.Resources/deployments', format('sql-role-definition-{0}', uniqueString(parameters('name')))), '2022-09-01').outputs.resourceId.value, parameters('principalIds')[copyIndex()], resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))]"
+                          },
+                          "databaseAccountName": {
+                            "value": "[parameters('databaseAccountName')]"
+                          },
+                          "roleDefinitionId": {
+                            "value": "[reference(resourceId('Microsoft.Resources/deployments', format('sql-role-definition-{0}', uniqueString(parameters('name')))), '2022-09-01').outputs.resourceId.value]"
+                          },
+                          "principalId": {
+                            "value": "[parameters('principalIds')[copyIndex()]]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.34.44.8038",
+                              "templateHash": "16164048892239373889"
+                            },
+                            "name": "DocumentDB Database Account SQL Role Assignments.",
+                            "description": "This module deploys a SQL Role Assignment in a CosmosDB Account."
+                          },
+                          "parameters": {
+                            "databaseAccountName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the SQL Role Assignment."
+                              }
+                            },
+                            "principalId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Id needs to be granted."
+                              }
+                            },
+                            "roleDefinitionId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Id of the SQL Role Definition."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
+                              "apiVersion": "2024-11-15",
+                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
+                              "properties": {
+                                "principalId": "[parameters('principalId')]",
+                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the SQL Role Assignment was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "[resourceId('Microsoft.Resources/deployments', format('sql-role-definition-{0}', uniqueString(parameters('name'))))]"
+                      ]
+                    }
+                  ],
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the SQL Role Definition and Assignment were created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "databaseAccount"
+              ]
+            },
+            "databaseAccount_mongodbDatabases": {
+              "copy": {
+                "name": "databaseAccount_mongodbDatabases",
+                "count": "[length(parameters('mongodbDatabases'))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-mongodb-{1}', uniqueString(deployment().name, parameters('location')), parameters('mongodbDatabases')[copyIndex()].name)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "databaseAccountName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[parameters('mongodbDatabases')[copyIndex()].name]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('mongodbDatabases')[copyIndex()], 'tags'), parameters('tags'))]"
+                  },
+                  "collections": {
+                    "value": "[tryGet(parameters('mongodbDatabases')[copyIndex()], 'collections')]"
+                  },
+                  "throughput": {
+                    "value": "[tryGet(parameters('mongodbDatabases')[copyIndex()], 'throughput')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "918699205331356852"
+                    },
+                    "name": "DocumentDB Database Account MongoDB Databases",
+                    "description": "This module deploys a MongoDB Database within a CosmosDB Account."
+                  },
+                  "parameters": {
+                    "databaseAccountName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the mongodb database."
+                      }
+                    },
+                    "throughput": {
+                      "type": "int",
+                      "defaultValue": 400,
+                      "metadata": {
+                        "description": "Optional. Request Units per second. Setting throughput at the database level is only recommended for development/test or when workload across all collections in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level."
+                      }
+                    },
+                    "collections": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Collections in the mongodb database."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "databaseAccount": {
+                      "existing": true,
+                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                      "apiVersion": "2024-11-15",
+                      "name": "[parameters('databaseAccountName')]"
+                    },
+                    "mongodbDatabase": {
+                      "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases",
+                      "apiVersion": "2024-11-15",
+                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "resource": {
+                          "id": "[parameters('name')]"
+                        },
+                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]"
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    },
+                    "mongodbDatabase_collections": {
+                      "copy": {
+                        "name": "mongodbDatabase_collections",
+                        "count": "[length(parameters('collections'))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-collection-{1}', uniqueString(deployment().name, parameters('name')), parameters('collections')[copyIndex()].name)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "databaseAccountName": {
+                            "value": "[parameters('databaseAccountName')]"
+                          },
+                          "mongodbDatabaseName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[parameters('collections')[copyIndex()].name]"
+                          },
+                          "indexes": {
+                            "value": "[parameters('collections')[copyIndex()].indexes]"
+                          },
+                          "shardKey": {
+                            "value": "[parameters('collections')[copyIndex()].shardKey]"
+                          },
+                          "throughput": {
+                            "value": "[tryGet(parameters('collections')[copyIndex()], 'throughput')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.34.44.8038",
+                              "templateHash": "5747070610235343863"
+                            },
+                            "name": "DocumentDB Database Account MongoDB Database Collections",
+                            "description": "This module deploys a MongoDB Database Collection."
+                          },
+                          "parameters": {
+                            "databaseAccountName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "mongodbDatabaseName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent mongodb database. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the collection."
+                              }
+                            },
+                            "throughput": {
+                              "type": "int",
+                              "defaultValue": 400,
+                              "metadata": {
+                                "description": "Optional. Request Units per second. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level."
+                              }
+                            },
+                            "indexes": {
+                              "type": "array",
+                              "metadata": {
+                                "description": "Required. Indexes for the collection."
+                              }
+                            },
+                            "shardKey": {
+                              "type": "object",
+                              "metadata": {
+                                "description": "Required. ShardKey for the collection."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections",
+                              "apiVersion": "2024-11-15",
+                              "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]",
+                              "properties": {
+                                "options": "[if(contains(reference(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), '2024-11-15').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]",
+                                "resource": {
+                                  "id": "[parameters('name')]",
+                                  "indexes": "[parameters('indexes')]",
+                                  "shardKey": "[parameters('shardKey')]"
+                                }
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the mongodb database collection."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the mongodb database collection."
+                              },
+                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the mongodb database collection was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "mongodbDatabase"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the mongodb database."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the mongodb database."
+                      },
+                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases', parameters('databaseAccountName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the mongodb database was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "databaseAccount"
+              ]
+            },
+            "databaseAccount_gremlinDatabases": {
+              "copy": {
+                "name": "databaseAccount_gremlinDatabases",
+                "count": "[length(parameters('gremlinDatabases'))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-gremlin-{1}', uniqueString(deployment().name, parameters('location')), parameters('gremlinDatabases')[copyIndex()].name)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "databaseAccountName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[parameters('gremlinDatabases')[copyIndex()].name]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('gremlinDatabases')[copyIndex()], 'tags'), parameters('tags'))]"
+                  },
+                  "graphs": {
+                    "value": "[tryGet(parameters('gremlinDatabases')[copyIndex()], 'graphs')]"
+                  },
+                  "maxThroughput": {
+                    "value": "[tryGet(parameters('gremlinDatabases')[copyIndex()], 'maxThroughput')]"
+                  },
+                  "throughput": {
+                    "value": "[tryGet(parameters('gremlinDatabases')[copyIndex()], 'throughput')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "3102415923148662010"
+                    },
+                    "name": "DocumentDB Database Account Gremlin Databases",
+                    "description": "This module deploys a Gremlin Database within a CosmosDB Account."
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the Gremlin database."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the Gremlin database resource."
+                      }
+                    },
+                    "databaseAccountName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Gremlin database. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "graphs": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Array of graphs to deploy in the Gremlin database."
+                      }
+                    },
+                    "maxThroughput": {
+                      "type": "int",
+                      "defaultValue": 4000,
+                      "metadata": {
+                        "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level."
+                      }
+                    },
+                    "throughput": {
+                      "type": "int",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "databaseAccount": {
+                      "existing": true,
+                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                      "apiVersion": "2024-11-15",
+                      "name": "[parameters('databaseAccountName')]"
+                    },
+                    "gremlinDatabase": {
+                      "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases",
+                      "apiVersion": "2024-11-15",
+                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]",
+                        "resource": {
+                          "id": "[parameters('name')]"
+                        }
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    },
+                    "gremlinDatabase_gremlinGraphs": {
+                      "copy": {
+                        "name": "gremlinDatabase_gremlinGraphs",
+                        "count": "[length(parameters('graphs'))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-gremlindb-{1}', uniqueString(deployment().name, parameters('name')), parameters('graphs')[copyIndex()].name)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('graphs')[copyIndex()].name]"
+                          },
+                          "gremlinDatabaseName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "databaseAccountName": {
+                            "value": "[parameters('databaseAccountName')]"
+                          },
+                          "indexingPolicy": {
+                            "value": "[tryGet(parameters('graphs')[copyIndex()], 'indexingPolicy')]"
+                          },
+                          "partitionKeyPaths": "[if(not(empty(parameters('graphs')[copyIndex()].partitionKeyPaths)), createObject('value', parameters('graphs')[copyIndex()].partitionKeyPaths), createObject('value', createArray()))]"
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.34.44.8038",
+                              "templateHash": "14448207336426896249"
+                            },
+                            "name": "DocumentDB Database Accounts Gremlin Databases Graphs",
+                            "description": "This module deploys a DocumentDB Database Accounts Gremlin Database Graph."
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the graph."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the Gremlin graph resource."
+                              }
+                            },
+                            "databaseAccountName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "gremlinDatabaseName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Gremlin Database. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "indexingPolicy": {
+                              "type": "object",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. Indexing policy of the graph."
+                              }
+                            },
+                            "partitionKeyPaths": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. List of paths using which data within the container can be partitioned."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "databaseAccount::gremlinDatabase": {
+                              "existing": true,
+                              "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases",
+                              "apiVersion": "2024-11-15",
+                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'))]"
+                            },
+                            "databaseAccount": {
+                              "existing": true,
+                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                              "apiVersion": "2024-11-15",
+                              "name": "[parameters('databaseAccountName')]"
+                            },
+                            "gremlinGraph": {
+                              "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs",
+                              "apiVersion": "2024-11-15",
+                              "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "resource": {
+                                  "id": "[parameters('name')]",
+                                  "indexingPolicy": "[if(not(empty(parameters('indexingPolicy'))), parameters('indexingPolicy'), null())]",
+                                  "partitionKey": {
+                                    "paths": "[if(not(empty(parameters('partitionKeyPaths'))), parameters('partitionKeyPaths'), null())]"
+                                  }
+                                }
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the graph."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the graph."
+                              },
+                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the graph was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "gremlinDatabase"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Gremlin database."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the Gremlin database."
+                      },
+                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases', parameters('databaseAccountName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the Gremlin database was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "databaseAccount"
+              ]
+            },
+            "databaseAccount_tables": {
+              "copy": {
+                "name": "databaseAccount_tables",
+                "count": "[length(parameters('tables'))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-table-{1}', uniqueString(deployment().name, parameters('location')), parameters('tables')[copyIndex()].name)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "databaseAccountName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[parameters('tables')[copyIndex()].name]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('tables')[copyIndex()], 'tags'), parameters('tags'))]"
+                  },
+                  "maxThroughput": {
+                    "value": "[tryGet(parameters('tables')[copyIndex()], 'maxThroughput')]"
+                  },
+                  "throughput": {
+                    "value": "[tryGet(parameters('tables')[copyIndex()], 'throughput')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "6386293577244138652"
+                    },
+                    "name": "Azure Cosmos DB account tables",
+                    "description": "This module deploys a table within an Azure Cosmos DB Account."
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the table."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags for the table."
+                      }
+                    },
+                    "databaseAccountName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Azure Cosmos DB account. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "maxThroughput": {
+                      "type": "int",
+                      "defaultValue": 4000,
+                      "metadata": {
+                        "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored."
+                      }
+                    },
+                    "throughput": {
+                      "type": "int",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "databaseAccount": {
+                      "existing": true,
+                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                      "apiVersion": "2024-11-15",
+                      "name": "[parameters('databaseAccountName')]"
+                    },
+                    "table": {
+                      "type": "Microsoft.DocumentDB/databaseAccounts/tables",
+                      "apiVersion": "2024-11-15",
+                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]",
+                        "resource": {
+                          "id": "[parameters('name')]"
+                        }
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the table."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the table."
+                      },
+                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/tables', parameters('databaseAccountName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the table was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "databaseAccount"
+              ]
+            },
+            "databaseAccount_privateEndpoints": {
+              "copy": {
+                "name": "databaseAccount_privateEndpoints",
+                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-databaseAccount-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+              "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]"
+                  },
+                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]",
+                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                  "subnetResourceId": {
+                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                  },
+                  "location": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                  },
+                  "lock": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                  },
+                  "privateDnsZoneGroup": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                  },
+                  "customDnsConfigs": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                  },
+                  "ipConfigurations": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                  },
+                  "applicationSecurityGroupResourceIds": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                  },
+                  "customNetworkInterfaceName": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.33.13.18514",
+                      "templateHash": "15954548978129725136"
+                    },
+                    "name": "Private Endpoints",
+                    "description": "This module deploys a Private Endpoint."
+                  },
+                  "definitions": {
+                    "privateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "ipConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "privateLinkServiceConnectionType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the private link service connection."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
+                              }
+                            },
+                            "privateLinkServiceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The resource id of private link service."
+                              }
+                            },
+                            "requestMessage": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private link service connection."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "customDnsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "private-dns-zone-group/main.bicep"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the private endpoint resource to create."
+                      }
+                    },
+                    "subnetResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                      }
+                    },
+                    "applicationSecurityGroupResourceIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                      }
+                    },
+                    "customNetworkInterfaceName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                      }
+                    },
+                    "ipConfigurations": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/ipConfigurationType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                      }
+                    },
+                    "privateDnsZoneGroup": {
+                      "$ref": "#/definitions/privateDnsZoneGroupType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                      }
+                    },
+                    "customDnsConfigs": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/customDnsConfigType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Custom DNS configurations."
+                      }
+                    },
+                    "manualPrivateLinkServiceConnections": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateLinkServiceConnectionType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                      }
+                    },
+                    "privateLinkServiceConnections": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateLinkServiceConnectionType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.10.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "privateEndpoint": {
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "applicationSecurityGroups",
+                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                            "input": {
+                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                            }
+                          }
+                        ],
+                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                        "subnet": {
+                          "id": "[parameters('subnetResourceId')]"
+                        }
+                      }
+                    },
+                    "privateEndpoint_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    },
+                    "privateEndpoint_roleAssignments": {
+                      "copy": {
+                        "name": "privateEndpoint_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    },
+                    "privateEndpoint_privateDnsZoneGroup": {
+                      "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                          },
+                          "privateEndpointName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "privateDnsZoneConfigs": {
+                            "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.33.13.18514",
+                              "templateHash": "5440815542537978381"
+                            },
+                            "name": "Private Endpoint Private DNS Zone Groups",
+                            "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                          },
+                          "definitions": {
+                            "privateDnsZoneGroupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private DNS zone group config."
+                                  }
+                                },
+                                "privateDnsZoneResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource id of the private DNS zone."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "privateEndpointName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "privateDnsZoneConfigs": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                              },
+                              "minLength": 1,
+                              "maxLength": 5,
+                              "metadata": {
+                                "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "default",
+                              "metadata": {
+                                "description": "Optional. The name of the private DNS zone group."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "privateDnsZoneConfigsVar",
+                                "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                "input": {
+                                  "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
+                                  "properties": {
+                                    "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
+                                  }
+                                }
+                              }
+                            ]
+                          },
+                          "resources": {
+                            "privateEndpoint": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateEndpoints",
+                              "apiVersion": "2023-11-01",
+                              "name": "[parameters('privateEndpointName')]"
+                            },
+                            "privateDnsZoneGroup": {
+                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                              "apiVersion": "2023-11-01",
+                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                              "properties": {
+                                "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private endpoint DNS zone group."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private endpoint DNS zone group."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private endpoint DNS zone group was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the private endpoint was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the private endpoint."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the private endpoint."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('privateEndpoint', '2023-11-01', 'full').location]"
+                    },
+                    "customDnsConfigs": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/customDnsConfigType"
+                      },
+                      "metadata": {
+                        "description": "The custom DNS configurations of the private endpoint."
+                      },
+                      "value": "[reference('privateEndpoint').customDnsConfigs]"
+                    },
+                    "networkInterfaceResourceIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "metadata": {
+                        "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                      },
+                      "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                    },
+                    "groupId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The group Id for the private endpoint Group."
+                      },
+                      "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "databaseAccount"
+              ]
+            },
+            "secretsExport": {
+              "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]",
+              "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]",
+              "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "keyVaultName": {
+                    "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]"
+                  },
+                  "secretsToSet": {
+                    "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'primaryWriteKeySecretName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'primaryWriteKeySecretName'), 'value', listKeys(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2024-11-15').primaryMasterKey)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'primaryReadOnlyKeySecretName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'primaryReadOnlyKeySecretName'), 'value', listKeys(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2024-11-15').primaryReadonlyMasterKey)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'primaryWriteConnectionStringSecretName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'primaryWriteConnectionStringSecretName'), 'value', listConnectionStrings(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2024-11-15').connectionStrings[0].connectionString)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'primaryReadonlyConnectionStringSecretName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'primaryReadonlyConnectionStringSecretName'), 'value', listConnectionStrings(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2024-11-15').connectionStrings[2].connectionString)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'secondaryWriteKeySecretName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'secondaryWriteKeySecretName'), 'value', listKeys(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2024-11-15').secondaryMasterKey)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'secondaryReadonlyKeySecretName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'secondaryReadonlyKeySecretName'), 'value', listKeys(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2024-11-15').secondaryReadonlyMasterKey)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'secondaryWriteConnectionStringSecretName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'secondaryWriteConnectionStringSecretName'), 'value', listConnectionStrings(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2024-11-15').connectionStrings[1].connectionString)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'secondaryReadonlyConnectionStringSecretName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'secondaryReadonlyConnectionStringSecretName'), 'value', listConnectionStrings(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2024-11-15').connectionStrings[3].connectionString)), createArray()))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "17295277467511711636"
+                    }
+                  },
+                  "definitions": {
+                    "secretSetType": {
+                      "type": "object",
+                      "properties": {
+                        "secretResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The resourceId of the exported secret."
+                          }
+                        },
+                        "secretUri": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The secret URI of the exported secret."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the secret set."
+                      }
+                    },
+                    "secretToSetType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the secret to set."
+                          }
+                        },
+                        "value": {
+                          "type": "securestring",
+                          "metadata": {
+                            "description": "Required. The value of the secret to set."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the secrets to set."
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "keyVaultName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the Key Vault to set the ecrets in."
+                      }
+                    },
+                    "secretsToSet": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/secretToSetType"
+                      },
+                      "metadata": {
+                        "description": "Required. The secrets to set in the Key Vault."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "keyVault": {
+                      "existing": true,
+                      "type": "Microsoft.KeyVault/vaults",
+                      "apiVersion": "2023-07-01",
+                      "name": "[parameters('keyVaultName')]"
+                    },
+                    "secrets": {
+                      "copy": {
+                        "name": "secrets",
+                        "count": "[length(parameters('secretsToSet'))]"
+                      },
+                      "type": "Microsoft.KeyVault/vaults/secrets",
+                      "apiVersion": "2023-07-01",
+                      "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]",
+                      "properties": {
+                        "value": "[parameters('secretsToSet')[copyIndex()].value]"
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "secretsSet": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/secretSetType"
+                      },
+                      "metadata": {
+                        "description": "The references to the secrets exported to the provided Key Vault."
+                      },
+                      "copy": {
+                        "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]",
+                        "input": {
+                          "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]",
+                          "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]"
+                        }
+                      }
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "databaseAccount"
+              ]
+            }
+          },
+          "outputs": {
+            "exportedSecrets": {
+              "$ref": "#/definitions/secretsOutputType",
+              "metadata": {
+                "description": "The references to the secrets exported to the provided Key Vault."
+              },
+              "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the database account."
+              },
+              "value": "[parameters('name')]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the database account."
+              },
+              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]"
+            },
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the resource group the database account was created in."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "systemAssignedMIPrincipalId": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "The principal ID of the system assigned identity."
+              },
+              "value": "[tryGet(tryGet(reference('databaseAccount', '2024-11-15', 'full'), 'identity'), 'principalId')]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('databaseAccount', '2024-11-15', 'full').location]"
+            },
+            "endpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "The endpoint of the database account."
+              },
+              "value": "[reference('databaseAccount').documentEndpoint]"
+            },
+            "privateEndpoints": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/privateEndpointOutputType"
+              },
+              "metadata": {
+                "description": "The private endpoints of the database account."
+              },
+              "copy": {
+                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                "input": {
+                  "name": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                  "resourceId": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                  "groupId": "[tryGet(tryGet(reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                  "customDnsConfigs": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                  "networkInterfaceResourceIds": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                }
+              }
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "containerApp",
+        "logAnalyticsWorkspace",
+        "privateDnsZonesCosmosDb",
+        "virtualNetwork"
+      ]
+    },
+    "containerAppEnvironment": {
+      "condition": "[variables('containerAppEnvironmentEnabled')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('module.container-app-environment.{0}', variables('containerAppEnvironmentResourceName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[variables('containerAppEnvironmentResourceName')]"
+          },
+          "tags": {
+            "value": "[coalesce(tryGet(parameters('containerAppEnvironmentConfiguration'), 'tags'), parameters('tags'))]"
+          },
+          "location": {
+            "value": "[coalesce(tryGet(parameters('containerAppEnvironmentConfiguration'), 'location'), parameters('solutionLocation'))]"
+          },
+          "logAnalyticsResourceId": "[if(variables('useExistingWorkspace'), createObject('value', variables('existingWorkspaceResourceId')), createObject('value', listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId))]",
+          "publicNetworkAccess": {
+            "value": "Enabled"
+          },
+          "zoneRedundant": {
+            "value": false
+          },
+          "applicationInsightsConnectionString": {
+            "value": "[reference('applicationInsights').outputs.connectionString.value]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "subnetResourceId": "[if(variables('virtualNetworkEnabled'), createObject('value', coalesce(coalesce(tryGet(parameters('containerAppEnvironmentConfiguration'), 'subnetResourceId'), tryGet(tryGet(tryGet(reference('virtualNetwork'), 'outputs'), 'subnetResourceIds'), 'value', 3)), '')), createObject('value', ''))]"
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.36.1.42791",
+              "templateHash": "4058239350318625283"
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string"
+            },
+            "location": {
+              "type": "string"
+            },
+            "logAnalyticsResourceId": {
+              "type": "string"
+            },
+            "tags": {
+              "type": "object"
+            },
+            "publicNetworkAccess": {
+              "type": "string"
+            },
+            "zoneRedundant": {
+              "type": "bool"
+            },
+            "enableTelemetry": {
+              "type": "bool"
+            },
+            "subnetResourceId": {
+              "type": "string"
+            },
+            "applicationInsightsConnectionString": {
+              "type": "string"
+            }
+          },
+          "variables": {
+            "logAnalyticsSubscription": "[split(parameters('logAnalyticsResourceId'), '/')[2]]",
+            "logAnalyticsResourceGroup": "[split(parameters('logAnalyticsResourceId'), '/')[4]]",
+            "logAnalyticsName": "[split(parameters('logAnalyticsResourceId'), '/')[8]]"
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[take(format('avm.res.app.managed-environment.{0}', parameters('name')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "appLogsConfiguration": {
+                    "value": {
+                      "destination": "log-analytics",
+                      "logAnalyticsConfiguration": {
+                        "customerId": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('logAnalyticsSubscription'), variables('logAnalyticsResourceGroup')), 'Microsoft.OperationalInsights/workspaces', variables('logAnalyticsName')), '2020-08-01').customerId]",
+                        "sharedKey": "[listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('logAnalyticsSubscription'), variables('logAnalyticsResourceGroup')), 'Microsoft.OperationalInsights/workspaces', variables('logAnalyticsName')), '2020-08-01').primarySharedKey]"
+                      }
+                    }
+                  },
+                  "workloadProfiles": {
+                    "value": [
+                      {
+                        "name": "Consumption",
+                        "workloadProfileType": "Consumption"
+                      }
+                    ]
+                  },
+                  "publicNetworkAccess": {
+                    "value": "[parameters('publicNetworkAccess')]"
+                  },
+                  "appInsightsConnectionString": {
+                    "value": "[parameters('applicationInsightsConnectionString')]"
+                  },
+                  "zoneRedundant": {
+                    "value": "[parameters('zoneRedundant')]"
+                  },
+                  "infrastructureSubnetResourceId": {
+                    "value": "[parameters('subnetResourceId')]"
+                  },
+                  "internal": {
+                    "value": false
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.35.1.17967",
+                      "templateHash": "7921731604646231285"
+                    },
+                    "name": "App ManagedEnvironments",
+                    "description": "This module deploys an App Managed Environment (also known as a Container App Environment)."
+                  },
+                  "definitions": {
+                    "certificateType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the certificate."
+                          }
+                        },
+                        "certificateType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "ImagePullTrustedCA",
+                            "ServerSSLCertificate"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The type of the certificate."
+                          }
+                        },
+                        "certificateValue": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The value of the certificate. PFX or PEM blob."
+                          }
+                        },
+                        "certificatePassword": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The password of the certificate."
+                          }
+                        },
+                        "certificateKeyVaultProperties": {
+                          "$ref": "#/definitions/certificateKeyVaultPropertiesType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A key vault reference."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a certificate."
+                      }
+                    },
+                    "storageType": {
+                      "type": "object",
+                      "properties": {
+                        "accessMode": {
+                          "type": "string",
+                          "allowedValues": [
+                            "ReadOnly",
+                            "ReadWrite"
+                          ],
+                          "metadata": {
+                            "description": "Required. Access mode for storage: \"ReadOnly\" or \"ReadWrite\"."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "NFS",
+                            "SMB"
+                          ],
+                          "metadata": {
+                            "description": "Required. Type of storage: \"SMB\" or \"NFS\"."
+                          }
+                        },
+                        "storageAccountName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Storage account name."
+                          }
+                        },
+                        "shareName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. File share name."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of the storage."
+                      }
+                    },
+                    "appLogsConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "destination": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The destination of the logs."
+                          }
+                        },
+                        "logAnalyticsConfiguration": {
+                          "type": "object",
+                          "properties": {
+                            "customerId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The Log Analytics Workspace ID."
+                              }
+                            },
+                            "sharedKey": {
+                              "type": "securestring",
+                              "metadata": {
+                                "description": "Required. The shared key of the Log Analytics workspace."
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The configuration for Log Analytics."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the App Logs Configuration."
+                      }
+                    },
+                    "certificateKeyVaultPropertiesType": {
+                      "type": "object",
+                      "properties": {
+                        "identityResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource ID of the identity. This is the identity that will be used to access the key vault."
+                          }
+                        },
+                        "keyVaultUrl": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. A key vault URL referencing the wildcard certificate that will be used for the custom domain."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for the certificate's key vault properties.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "certificates/main.bicep"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "managedIdentityAllType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the Container Apps Managed Environment."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentityAllType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "appInsightsConnectionString": {
+                      "type": "securestring",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Application Insights connection string."
+                      }
+                    },
+                    "daprAIConnectionString": {
+                      "type": "securestring",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Application Insights connection string used by Dapr to export Service to Service communication telemetry."
+                      }
+                    },
+                    "daprAIInstrumentationKey": {
+                      "type": "securestring",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Azure Monitor instrumentation key used by Dapr to export Service to Service communication telemetry."
+                      }
+                    },
+                    "dockerBridgeCidr": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Conditional. CIDR notation IP range assigned to the Docker bridge, network. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant."
+                      }
+                    },
+                    "infrastructureSubnetResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Conditional. Resource ID of a subnet for infrastructure components. This is used to deploy the environment into a virtual network. Must not overlap with any other provided IP ranges. Required if \"internal\" is set to true. Required if zoneRedundant is set to true to make the resource WAF compliant."
+                      }
+                    },
+                    "internal": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Conditional. Boolean indicating the environment only has an internal load balancer. These environments do not have a public static IP resource. If set to true, then \"infrastructureSubnetId\" must be provided. Required if zoneRedundant is set to true to make the resource WAF compliant."
+                      }
+                    },
+                    "platformReservedCidr": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Conditional. IP range in CIDR notation that can be reserved for environment infrastructure IP addresses. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true  to make the resource WAF compliant."
+                      }
+                    },
+                    "platformReservedDnsIP": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Conditional. An IP address from the IP range defined by \"platformReservedCidr\" that will be reserved for the internal DNS server. It must not be the first address in the range and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant."
+                      }
+                    },
+                    "peerTrafficEncryption": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Whether or not to encrypt peer traffic."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "defaultValue": "Disabled",
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Whether to allow or block all public traffic."
+                      }
+                    },
+                    "zoneRedundant": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Whether or not this Managed Environment is zone-redundant."
+                      }
+                    },
+                    "certificatePassword": {
+                      "type": "securestring",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Password of the certificate used by the custom domain."
+                      }
+                    },
+                    "certificateValue": {
+                      "type": "securestring",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Certificate to use for the custom domain. PFX or PEM."
+                      }
+                    },
+                    "dnsSuffix": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. DNS suffix for the environment domain."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "openTelemetryConfiguration": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Open Telemetry configuration."
+                      }
+                    },
+                    "workloadProfiles": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Conditional. Workload profiles configured for the Managed Environment. Required if zoneRedundant is set to true to make the resource WAF compliant."
+                      }
+                    },
+                    "infrastructureResourceGroupName": {
+                      "type": "string",
+                      "defaultValue": "[take(format('ME_{0}', parameters('name')), 63)]",
+                      "metadata": {
+                        "description": "Conditional. Name of the infrastructure resource group. If not provided, it will be set with a default value. Required if zoneRedundant is set to true to make the resource WAF compliant."
+                      }
+                    },
+                    "storages": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/storageType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The list of storages to mount on the environment."
+                      }
+                    },
+                    "certificate": {
+                      "$ref": "#/definitions/certificateType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. A Managed Environment Certificate."
+                      }
+                    },
+                    "appLogsConfiguration": {
+                      "$ref": "#/definitions/appLogsConfigurationType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The AppLogsConfiguration for the Managed Environment."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "managedEnvironment::storage": {
+                      "copy": {
+                        "name": "managedEnvironment::storage",
+                        "count": "[length(coalesce(parameters('storages'), createArray()))]"
+                      },
+                      "type": "Microsoft.App/managedEnvironments/storages",
+                      "apiVersion": "2024-10-02-preview",
+                      "name": "[format('{0}/{1}', parameters('name'), coalesce(parameters('storages'), createArray())[copyIndex()].shareName)]",
+                      "properties": {
+                        "nfsAzureFile": "[if(equals(coalesce(parameters('storages'), createArray())[copyIndex()].kind, 'NFS'), createObject('accessMode', coalesce(parameters('storages'), createArray())[copyIndex()].accessMode, 'server', format('{0}.file.{1}', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName, environment().suffixes.storage), 'shareName', format('/{0}/{1}', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName, coalesce(parameters('storages'), createArray())[copyIndex()].shareName)), null())]",
+                        "azureFile": "[if(equals(coalesce(parameters('storages'), createArray())[copyIndex()].kind, 'SMB'), createObject('accessMode', coalesce(parameters('storages'), createArray())[copyIndex()].accessMode, 'accountName', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName, 'accountKey', listkeys(resourceId('Microsoft.Storage/storageAccounts', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName), '2023-01-01').keys[0].value, 'shareName', coalesce(parameters('storages'), createArray())[copyIndex()].shareName), null())]"
+                      },
+                      "dependsOn": [
+                        "managedEnvironment"
+                      ]
+                    },
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-11-01",
+                      "name": "[format('46d3xbcp.res.app-managedenvironment.{0}.{1}', replace('0.11.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "managedEnvironment": {
+                      "type": "Microsoft.App/managedEnvironments",
+                      "apiVersion": "2024-10-02-preview",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "identity": "[variables('identity')]",
+                      "properties": {
+                        "appInsightsConfiguration": {
+                          "connectionString": "[parameters('appInsightsConnectionString')]"
+                        },
+                        "appLogsConfiguration": "[parameters('appLogsConfiguration')]",
+                        "daprAIConnectionString": "[parameters('daprAIConnectionString')]",
+                        "daprAIInstrumentationKey": "[parameters('daprAIInstrumentationKey')]",
+                        "customDomainConfiguration": {
+                          "certificatePassword": "[parameters('certificatePassword')]",
+                          "certificateValue": "[if(not(empty(parameters('certificateValue'))), parameters('certificateValue'), null())]",
+                          "dnsSuffix": "[parameters('dnsSuffix')]",
+                          "certificateKeyVaultProperties": "[if(not(empty(tryGet(parameters('certificate'), 'certificateKeyVaultProperties'))), createObject('identity', tryGet(parameters('certificate'), 'certificateKeyVaultProperties', 'identityResourceId'), 'keyVaultUrl', tryGet(parameters('certificate'), 'certificateKeyVaultProperties', 'keyVaultUrl')), null())]"
+                        },
+                        "openTelemetryConfiguration": "[if(not(empty(parameters('openTelemetryConfiguration'))), parameters('openTelemetryConfiguration'), null())]",
+                        "peerTrafficConfiguration": {
+                          "encryption": {
+                            "enabled": "[parameters('peerTrafficEncryption')]"
+                          }
+                        },
+                        "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
+                        "vnetConfiguration": {
+                          "internal": "[parameters('internal')]",
+                          "infrastructureSubnetId": "[if(not(empty(parameters('infrastructureSubnetResourceId'))), parameters('infrastructureSubnetResourceId'), null())]",
+                          "dockerBridgeCidr": "[if(not(empty(parameters('infrastructureSubnetResourceId'))), parameters('dockerBridgeCidr'), null())]",
+                          "platformReservedCidr": "[if(and(empty(parameters('workloadProfiles')), not(empty(parameters('infrastructureSubnetResourceId')))), parameters('platformReservedCidr'), null())]",
+                          "platformReservedDnsIP": "[if(and(empty(parameters('workloadProfiles')), not(empty(parameters('infrastructureSubnetResourceId')))), parameters('platformReservedDnsIP'), null())]"
+                        },
+                        "workloadProfiles": "[if(not(empty(parameters('workloadProfiles'))), parameters('workloadProfiles'), null())]",
+                        "zoneRedundant": "[parameters('zoneRedundant')]",
+                        "infrastructureResourceGroup": "[parameters('infrastructureResourceGroupName')]"
+                      }
+                    },
+                    "managedEnvironment_roleAssignments": {
+                      "copy": {
+                        "name": "managedEnvironment_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.App/managedEnvironments/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.App/managedEnvironments', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "managedEnvironment"
+                      ]
+                    },
+                    "managedEnvironment_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.App/managedEnvironments/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "managedEnvironment"
+                      ]
+                    },
+                    "managedEnvironment_certificate": {
+                      "condition": "[not(empty(parameters('certificate')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Managed-Environment-Certificate', uniqueString(deployment().name))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(tryGet(parameters('certificate'), 'name'), format('cert-{0}', parameters('name')))]"
+                          },
+                          "managedEnvironmentName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "certificateKeyVaultProperties": {
+                            "value": "[tryGet(parameters('certificate'), 'certificateKeyVaultProperties')]"
+                          },
+                          "certificateType": {
+                            "value": "[tryGet(parameters('certificate'), 'certificateType')]"
+                          },
+                          "certificateValue": {
+                            "value": "[tryGet(parameters('certificate'), 'certificateValue')]"
+                          },
+                          "certificatePassword": {
+                            "value": "[tryGet(parameters('certificate'), 'certificatePassword')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.35.1.17967",
+                              "templateHash": "18123249047188753287"
+                            },
+                            "name": "App ManagedEnvironments Certificates",
+                            "description": "This module deploys a App Managed Environment Certificate."
+                          },
+                          "definitions": {
+                            "certificateKeyVaultPropertiesType": {
+                              "type": "object",
+                              "properties": {
+                                "identityResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource ID of the identity. This is the identity that will be used to access the key vault."
+                                  }
+                                },
+                                "keyVaultUrl": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. A key vault URL referencing the wildcard certificate that will be used for the custom domain."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the certificate's key vault properties."
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the Container Apps Managed Environment Certificate."
+                              }
+                            },
+                            "managedEnvironmentName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent app managed environment. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "certificateKeyVaultProperties": {
+                              "$ref": "#/definitions/certificateKeyVaultPropertiesType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. A key vault reference to the certificate to use for the custom domain."
+                              }
+                            },
+                            "certificateType": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "ServerSSLCertificate",
+                                "ImagePullTrustedCA"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The type of the certificate."
+                              }
+                            },
+                            "certificateValue": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The value of the certificate. PFX or PEM blob."
+                              }
+                            },
+                            "certificatePassword": {
+                              "type": "securestring",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The password of the certificate."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the resource."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "managedEnvironment": {
+                              "existing": true,
+                              "type": "Microsoft.App/managedEnvironments",
+                              "apiVersion": "2024-10-02-preview",
+                              "name": "[parameters('managedEnvironmentName')]"
+                            },
+                            "managedEnvironmentCertificate": {
+                              "type": "Microsoft.App/managedEnvironments/certificates",
+                              "apiVersion": "2024-10-02-preview",
+                              "name": "[format('{0}/{1}', parameters('managedEnvironmentName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "properties": {
+                                "certificateKeyVaultProperties": "[if(not(empty(parameters('certificateKeyVaultProperties'))), createObject('identity', parameters('certificateKeyVaultProperties').identityResourceId, 'keyVaultUrl', parameters('certificateKeyVaultProperties').keyVaultUrl), null())]",
+                                "certificateType": "[parameters('certificateType')]",
+                                "password": "[parameters('certificatePassword')]",
+                                "value": "[parameters('certificateValue')]"
+                              },
+                              "tags": "[parameters('tags')]"
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the key values."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the key values."
+                              },
+                              "value": "[resourceId('Microsoft.App/managedEnvironments/certificates', parameters('managedEnvironmentName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the batch account was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "managedEnvironment"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the Managed Environment was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('managedEnvironment', '2024-10-02-preview', 'full').location]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Managed Environment."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the Managed Environment."
+                      },
+                      "value": "[resourceId('Microsoft.App/managedEnvironments', parameters('name'))]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[tryGet(tryGet(reference('managedEnvironment', '2024-10-02-preview', 'full'), 'identity'), 'principalId')]"
+                    },
+                    "defaultDomain": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The Default domain of the Managed Environment."
+                      },
+                      "value": "[reference('managedEnvironment').defaultDomain]"
+                    },
+                    "staticIp": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The IP address of the Managed Environment."
+                      },
+                      "value": "[reference('managedEnvironment').staticIp]"
+                    },
+                    "domainVerificationId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The domain verification id for custom domains."
+                      },
+                      "value": "[reference('managedEnvironment').customDomainConfiguration.customDomainVerificationId]"
+                    }
+                  }
+                }
+              }
+            }
+          ],
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.app.managed-environment.{0}', parameters('name')), 64)), '2022-09-01').outputs.resourceId.value]"
+            },
+            "location": {
+              "type": "string",
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.app.managed-environment.{0}', parameters('name')), 64)), '2022-09-01').outputs.location.value]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "applicationInsights",
+        "logAnalyticsWorkspace",
+        "virtualNetwork"
+      ]
+    },
+    "containerApp": {
+      "condition": "[variables('containerAppEnabled')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('avm.res.app.container-app.{0}', variables('containerAppResourceName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[variables('containerAppResourceName')]"
+          },
+          "tags": {
+            "value": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'tags'), parameters('tags'))]"
+          },
+          "location": {
+            "value": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'location'), parameters('solutionLocation'))]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "environmentResourceId": {
+            "value": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'environmentResourceId'), reference('containerAppEnvironment').outputs.resourceId.value)]"
+          },
+          "managedIdentities": {
+            "value": {
+              "systemAssigned": true,
+              "userAssignedResourceIds": [
+                "[reference('userAssignedIdentity').outputs.resourceId.value]"
+              ]
+            }
+          },
+          "ingressTargetPort": {
+            "value": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'ingressTargetPort'), 8000)]"
+          },
+          "ingressExternal": {
+            "value": true
+          },
+          "activeRevisionsMode": {
+            "value": "Single"
+          },
+          "corsPolicy": {
+            "value": {
+              "allowedOrigins": [
+                "[format('https://{0}.azurewebsites.net', variables('webSiteName'))]",
+                "[format('http://{0}.azurewebsites.net', variables('webSiteName'))]"
+              ]
+            }
+          },
+          "scaleSettings": {
+            "value": {
+              "maxReplicas": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'maxReplicas'), 1)]",
+              "minReplicas": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'minReplicas'), 1)]",
+              "rules": [
+                {
+                  "name": "http-scaler",
+                  "http": {
+                    "metadata": {
+                      "concurrentRequests": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'concurrentRequests'), '100')]"
+                    }
+                  }
+                }
+              ]
+            }
+          },
+          "containers": {
+            "value": [
+              {
+                "name": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'containerName'), 'backend')]",
+                "image": "[format('{0}/{1}:{2}', coalesce(tryGet(parameters('containerAppConfiguration'), 'containerImageRegistryDomain'), 'biabcontainerreg.azurecr.io'), coalesce(tryGet(parameters('containerAppConfiguration'), 'containerImageName'), 'macaebackend'), coalesce(tryGet(parameters('containerAppConfiguration'), 'containerImageTag'), 'latest'))]",
+                "resources": {
+                  "cpu": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'containerCpu'), '2.0')]",
+                  "memory": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'containerMemory'), '4.0Gi')]"
+                },
+                "env": [
+                  {
+                    "name": "COSMOSDB_ENDPOINT",
+                    "value": "[format('https://{0}.documents.azure.com:443/', variables('cosmosDbResourceName'))]"
+                  },
+                  {
+                    "name": "COSMOSDB_DATABASE",
+                    "value": "[variables('cosmosDbDatabaseName')]"
+                  },
+                  {
+                    "name": "COSMOSDB_CONTAINER",
+                    "value": "[variables('cosmosDbDatabaseMemoryContainerName')]"
+                  },
+                  {
+                    "name": "AZURE_OPENAI_ENDPOINT",
+                    "value": "[format('https://{0}.openai.azure.com/', variables('aiFoundryAiServicesResourceName'))]"
+                  },
+                  {
+                    "name": "AZURE_OPENAI_MODEL_NAME",
+                    "value": "[variables('aiFoundryAiServicesModelDeployment').name]"
+                  },
+                  {
+                    "name": "AZURE_OPENAI_DEPLOYMENT_NAME",
+                    "value": "[variables('aiFoundryAiServicesModelDeployment').name]"
+                  },
+                  {
+                    "name": "AZURE_OPENAI_API_VERSION",
+                    "value": "2025-01-01-preview"
+                  },
+                  {
+                    "name": "APPLICATIONINSIGHTS_INSTRUMENTATION_KEY",
+                    "value": "[reference('applicationInsights').outputs.instrumentationKey.value]"
+                  },
+                  {
+                    "name": "APPLICATIONINSIGHTS_CONNECTION_STRING",
+                    "value": "[reference('applicationInsights').outputs.connectionString.value]"
+                  },
+                  {
+                    "name": "AZURE_AI_SUBSCRIPTION_ID",
+                    "value": "[subscription().subscriptionId]"
+                  },
+                  {
+                    "name": "AZURE_AI_RESOURCE_GROUP",
+                    "value": "[resourceGroup().name]"
+                  },
+                  {
+                    "name": "AZURE_AI_PROJECT_NAME",
+                    "value": "[variables('aiFoundryAiProjectName')]"
+                  },
+                  {
+                    "name": "FRONTEND_SITE_NAME",
+                    "value": "[format('https://{0}.azurewebsites.net', variables('webSiteName'))]"
+                  },
+                  {
+                    "name": "AZURE_AI_AGENT_ENDPOINT",
+                    "value": "[reference('aiFoundryProject').endpoints['AI Foundry API']]"
+                  },
+                  {
+                    "name": "AZURE_AI_AGENT_MODEL_DEPLOYMENT_NAME",
+                    "value": "[variables('aiFoundryAiServicesModelDeployment').name]"
+                  }
+                ]
+              }
+            ]
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.34.44.8038",
+              "templateHash": "18305799083153878117"
+            },
+            "name": "Container Apps",
+            "description": "This module deploys a Container App."
+          },
+          "definitions": {
+            "containerType": {
+              "type": "object",
+              "properties": {
+                "args": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Container start command arguments."
+                  }
+                },
+                "command": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Container start command."
+                  }
+                },
+                "env": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/environmentVarType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Container environment variables."
+                  }
+                },
+                "image": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Container image tag."
+                  }
+                },
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Custom container name."
+                  }
+                },
+                "probes": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/containerAppProbeType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. List of probes for the container."
+                  }
+                },
+                "resources": {
+                  "type": "object",
+                  "metadata": {
+                    "description": "Required. Container resource requirements."
+                  }
+                },
+                "volumeMounts": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/volumeMountType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Container volume mounts."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for a container."
+              }
+            },
+            "ingressPortMappingType": {
+              "type": "object",
+              "properties": {
+                "exposedPort": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specifies the exposed port for the target port. If not specified, it defaults to target port."
+                  }
+                },
+                "external": {
+                  "type": "bool",
+                  "metadata": {
+                    "description": "Required. Specifies whether the app port is accessible outside of the environment."
+                  }
+                },
+                "targetPort": {
+                  "type": "int",
+                  "metadata": {
+                    "description": "Required. Specifies the port the container listens on."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for an ingress port mapping."
+              }
+            },
+            "serviceBindingType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the service."
+                  }
+                },
+                "serviceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The service ID."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "The type for a service binding."
+              }
+            },
+            "environmentVarType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Environment variable name."
+                  }
+                },
+                "secretRef": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Name of the Container App secret from which to pull the environment variable value."
+                  }
+                },
+                "value": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Non-secret environment variable value."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for an environment variable."
+              }
+            },
+            "containerAppProbeType": {
+              "type": "object",
+              "properties": {
+                "failureThreshold": {
+                  "type": "int",
+                  "nullable": true,
+                  "minValue": 1,
+                  "maxValue": 10,
+                  "metadata": {
+                    "description": "Optional. Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3."
+                  }
+                },
+                "httpGet": {
+                  "$ref": "#/definitions/containerAppProbeHttpGetType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. HTTPGet specifies the http request to perform."
+                  }
+                },
+                "initialDelaySeconds": {
+                  "type": "int",
+                  "nullable": true,
+                  "minValue": 1,
+                  "maxValue": 60,
+                  "metadata": {
+                    "description": "Optional. Number of seconds after the container has started before liveness probes are initiated."
+                  }
+                },
+                "periodSeconds": {
+                  "type": "int",
+                  "nullable": true,
+                  "minValue": 1,
+                  "maxValue": 240,
+                  "metadata": {
+                    "description": "Optional. How often (in seconds) to perform the probe. Default to 10 seconds."
+                  }
+                },
+                "successThreshold": {
+                  "type": "int",
+                  "nullable": true,
+                  "minValue": 1,
+                  "maxValue": 10,
+                  "metadata": {
+                    "description": "Optional. Minimum consecutive successes for the probe to be considered successful after having failed. Defaults to 1. Must be 1 for liveness and startup."
+                  }
+                },
+                "tcpSocket": {
+                  "$ref": "#/definitions/containerAppProbeTcpSocketType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The TCP socket specifies an action involving a TCP port. TCP hooks not yet supported."
+                  }
+                },
+                "terminationGracePeriodSeconds": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Optional duration in seconds the pod needs to terminate gracefully upon probe failure. The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this value overrides the value provided by the pod spec. Value must be non-negative integer. The value zero indicates stop immediately via the kill signal (no opportunity to shut down). This is an alpha field and requires enabling ProbeTerminationGracePeriod feature gate. Maximum value is 3600 seconds (1 hour)."
+                  }
+                },
+                "timeoutSeconds": {
+                  "type": "int",
+                  "nullable": true,
+                  "minValue": 1,
+                  "maxValue": 240,
+                  "metadata": {
+                    "description": "Optional. Number of seconds after which the probe times out. Defaults to 1 second."
+                  }
+                },
+                "type": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Liveness",
+                    "Readiness",
+                    "Startup"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The type of probe."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "The type for a container app probe."
+              }
+            },
+            "corsPolicyType": {
+              "type": "object",
+              "properties": {
+                "allowCredentials": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Switch to determine whether the resource allows credentials."
+                  }
+                },
+                "allowedHeaders": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specifies the content for the access-control-allow-headers header."
+                  }
+                },
+                "allowedMethods": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specifies the content for the access-control-allow-methods header."
+                  }
+                },
+                "allowedOrigins": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specifies the content for the access-control-allow-origins header."
+                  }
+                },
+                "exposeHeaders": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specifies the content for the access-control-expose-headers header."
+                  }
+                },
+                "maxAge": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specifies the content for the access-control-max-age header."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for a CORS policy."
+              }
+            },
+            "containerAppProbeHttpGetType": {
+              "type": "object",
+              "properties": {
+                "host": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Host name to connect to. Defaults to the pod IP."
+                  }
+                },
+                "httpHeaders": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/containerAppProbeHttpGetHeadersItemType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. HTTP headers to set in the request."
+                  }
+                },
+                "path": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Path to access on the HTTP server."
+                  }
+                },
+                "port": {
+                  "type": "int",
+                  "metadata": {
+                    "description": "Required. Name or number of the port to access on the container."
+                  }
+                },
+                "scheme": {
+                  "type": "string",
+                  "allowedValues": [
+                    "HTTP",
+                    "HTTPS"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Scheme to use for connecting to the host. Defaults to HTTP."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "The type for a container app probe HTTP GET."
+              }
+            },
+            "containerAppProbeHttpGetHeadersItemType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Name of the header."
+                  }
+                },
+                "value": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Value of the header."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "The type for a container app probe HTTP GET header."
+              }
+            },
+            "containerAppProbeTcpSocketType": {
+              "type": "object",
+              "properties": {
+                "host": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Host name to connect to, defaults to the pod IP."
+                  }
+                },
+                "port": {
+                  "type": "int",
+                  "minValue": 1,
+                  "maxValue": 65535,
+                  "metadata": {
+                    "description": "Required. Number of the port to access on the container. Name must be an IANA_SVC_NAME."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "The type for a container app probe TCP socket."
+              }
+            },
+            "scaleType": {
+              "type": "object",
+              "properties": {
+                "maxReplicas": {
+                  "type": "int",
+                  "metadata": {
+                    "description": "Required. The maximum number of replicas."
+                  }
+                },
+                "minReplicas": {
+                  "type": "int",
+                  "metadata": {
+                    "description": "Required. The minimum number of replicas."
+                  }
+                },
+                "cooldownPeriod": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The cooldown period in seconds."
+                  }
+                },
+                "pollingInterval": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The polling interval in seconds."
+                  }
+                },
+                "rules": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/scaleRuleType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The scaling rules."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "The scale settings for the Container App."
+              }
+            },
+            "scaleRuleType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the scaling rule."
+                  }
+                },
+                "custom": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The custom scaling rule."
+                  }
+                },
+                "azureQueue": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Azure Queue based scaling rule."
+                  }
+                },
+                "http": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The HTTP requests based scaling rule."
+                  }
+                },
+                "tcp": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The TCP based scaling rule."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "The scaling rules for the Container App."
+              }
+            },
+            "volumeMountType": {
+              "type": "object",
+              "properties": {
+                "mountPath": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Path within the container at which the volume should be mounted.Must not contain ':'."
+                  }
+                },
+                "subPath": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Path within the volume from which the container's volume should be mounted. Defaults to \"\" (volume's root)."
+                  }
+                },
+                "volumeName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. This must match the Name of a Volume."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "The type for a volume mount."
+              }
+            },
+            "runtimeType": {
+              "type": "object",
+              "properties": {
+                "dotnet": {
+                  "type": "object",
+                  "properties": {
+                    "autoConfigureDataProtection": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Enable to auto configure the ASP.NET Core Data Protection feature."
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Runtime configuration for ASP.NET Core."
+                  }
+                },
+                "java": {
+                  "type": "object",
+                  "properties": {
+                    "enableMetrics": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Enable JMX core metrics for the Java app."
+                      }
+                    },
+                    "enableJavaAgent": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Enable Java agent injection for the Java app."
+                      }
+                    },
+                    "loggerSettings": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "logger": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. Name of the logger."
+                            }
+                          },
+                          "level": {
+                            "type": "string",
+                            "allowedValues": [
+                              "debug",
+                              "error",
+                              "info",
+                              "off",
+                              "trace",
+                              "warn"
+                            ],
+                            "metadata": {
+                              "description": "Required. Java agent logging level."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Java agent logging configuration."
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Runtime configuration for Java."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "Optional. App runtime configuration for the Container App."
+              }
+            },
+            "secretType": {
+              "type": "object",
+              "properties": {
+                "identity": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of a managed identity to authenticate with Azure Key Vault, or System to use a system-assigned identity."
+                  }
+                },
+                "keyVaultUrl": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Conditional. The URL of the Azure Key Vault secret referenced by the Container App. Required if `value` is null."
+                  }
+                },
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the container app secret."
+                  }
+                },
+                "value": {
+                  "type": "securestring",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Conditional. The container app secret value, if not fetched from the Key Vault. Required if `keyVaultUrl` is not null."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "The type for a secret."
+              }
+            },
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a lock.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
+                }
+              }
+            },
+            "managedIdentityAllType": {
+              "type": "object",
+              "properties": {
+                "systemAssigned": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enables system assigned managed identity on the resource."
+                  }
+                },
+                "userAssignedResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
+                }
+              }
+            },
+            "roleAssignmentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                  }
+                },
+                "roleDefinitionIdOrName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                  }
+                },
+                "principalId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                  }
+                },
+                "principalType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Device",
+                    "ForeignGroup",
+                    "Group",
+                    "ServicePrincipal",
+                    "User"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The principal type of the assigned principal ID."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The description of the role assignment."
+                  }
+                },
+                "condition": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                  }
+                },
+                "conditionVersion": {
+                  "type": "string",
+                  "allowedValues": [
+                    "2.0"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Version of the condition."
+                  }
+                },
+                "delegatedManagedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a role assignment.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
+                }
+              }
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name of the Container App."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all Resources."
+              }
+            },
+            "disableIngress": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Bool to disable all ingress traffic for the container app."
+              }
+            },
+            "ingressExternal": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Bool indicating if the App exposes an external HTTP endpoint."
+              }
+            },
+            "clientCertificateMode": {
+              "type": "string",
+              "defaultValue": "ignore",
+              "allowedValues": [
+                "accept",
+                "ignore",
+                "require"
+              ],
+              "metadata": {
+                "description": "Optional. Client certificate mode for mTLS."
+              }
+            },
+            "corsPolicy": {
+              "$ref": "#/definitions/corsPolicyType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Object userd to configure CORS policy."
+              }
+            },
+            "stickySessionsAffinity": {
+              "type": "string",
+              "defaultValue": "none",
+              "allowedValues": [
+                "none",
+                "sticky"
+              ],
+              "metadata": {
+                "description": "Optional. Bool indicating if the Container App should enable session affinity."
+              }
+            },
+            "ingressTransport": {
+              "type": "string",
+              "defaultValue": "auto",
+              "allowedValues": [
+                "auto",
+                "http",
+                "http2",
+                "tcp"
+              ],
+              "metadata": {
+                "description": "Optional. Ingress transport protocol."
+              }
+            },
+            "service": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. Dev ContainerApp service type."
+              }
+            },
+            "includeAddOns": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Toggle to include the service configuration."
+              }
+            },
+            "additionalPortMappings": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/ingressPortMappingType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Settings to expose additional ports on container app."
+              }
+            },
+            "ingressAllowInsecure": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Bool indicating if HTTP connections to is allowed. If set to false HTTP connections are automatically redirected to HTTPS connections."
+              }
+            },
+            "ingressTargetPort": {
+              "type": "int",
+              "defaultValue": 80,
+              "metadata": {
+                "description": "Optional. Target Port in containers for traffic from ingress."
+              }
+            },
+            "scaleSettings": {
+              "$ref": "#/definitions/scaleType",
+              "defaultValue": {
+                "maxReplicas": 10,
+                "minReplicas": 3
+              },
+              "metadata": {
+                "description": "Optional. The scaling settings of the service."
+              }
+            },
+            "serviceBinds": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/serviceBindingType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. List of container app services bound to the app."
+              }
+            },
+            "activeRevisionsMode": {
+              "type": "string",
+              "defaultValue": "Single",
+              "allowedValues": [
+                "Multiple",
+                "Single"
+              ],
+              "metadata": {
+                "description": "Optional. Controls how active revisions are handled for the Container app."
+              }
+            },
+            "environmentResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Resource ID of environment."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the resource."
+              }
+            },
+            "registries": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. Collection of private container registry credentials for containers used by the Container app."
+              }
+            },
+            "managedIdentities": {
+              "$ref": "#/definitions/managedIdentityAllType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The managed identity definition for this resource."
+              }
+            },
+            "roleAssignments": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/roleAssignmentType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "customDomains": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. Custom domain bindings for Container App hostnames."
+              }
+            },
+            "exposedPort": {
+              "type": "int",
+              "defaultValue": 0,
+              "metadata": {
+                "description": "Optional. Exposed Port in containers for TCP traffic from ingress."
+              }
+            },
+            "ipSecurityRestrictions": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. Rules to restrict incoming IP address."
+              }
+            },
+            "trafficLabel": {
+              "type": "string",
+              "defaultValue": "label-1",
+              "metadata": {
+                "description": "Optional. Associates a traffic label with a revision. Label name should be consist of lower case alphanumeric characters or dashes."
+              }
+            },
+            "trafficLatestRevision": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Indicates that the traffic weight belongs to a latest stable revision."
+              }
+            },
+            "trafficRevisionName": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Name of a revision."
+              }
+            },
+            "trafficWeight": {
+              "type": "int",
+              "defaultValue": 100,
+              "metadata": {
+                "description": "Optional. Traffic weight assigned to a revision."
+              }
+            },
+            "dapr": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. Dapr configuration for the Container App."
+              }
+            },
+            "maxInactiveRevisions": {
+              "type": "int",
+              "defaultValue": 0,
+              "metadata": {
+                "description": "Optional. Max inactive revisions a Container App can have."
+              }
+            },
+            "runtime": {
+              "$ref": "#/definitions/runtimeType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Runtime configuration for the Container App."
+              }
+            },
+            "containers": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/containerType"
+              },
+              "metadata": {
+                "description": "Required. List of container definitions for the Container App."
+              }
+            },
+            "initContainersTemplate": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. List of specialized containers that run before app containers."
+              }
+            },
+            "secrets": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/secretType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The secrets of the Container App."
+              }
+            },
+            "revisionSuffix": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. User friendly suffix that is appended to the revision name."
+              }
+            },
+            "volumes": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. List of volume definitions for the Container App."
+              }
+            },
+            "workloadProfileName": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Workload profile name to pin for container app execution."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "formattedRoleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+              }
+            ],
+            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+            "builtInRoleNames": {
+              "ContainerApp Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ad2dd5fb-cd4b-4fd4-a9b6-4fed3630980b')]",
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+            }
+          },
+          "resources": {
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.app-containerapp.{0}.{1}', replace('0.14.2', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "containerApp": {
+              "type": "Microsoft.App/containerApps",
+              "apiVersion": "2024-10-02-preview",
+              "name": "[parameters('name')]",
+              "tags": "[parameters('tags')]",
+              "location": "[parameters('location')]",
+              "identity": "[variables('identity')]",
+              "properties": {
+                "environmentId": "[parameters('environmentResourceId')]",
+                "configuration": {
+                  "activeRevisionsMode": "[parameters('activeRevisionsMode')]",
+                  "dapr": "[if(not(empty(parameters('dapr'))), parameters('dapr'), null())]",
+                  "ingress": "[if(parameters('disableIngress'), null(), createObject('additionalPortMappings', parameters('additionalPortMappings'), 'allowInsecure', if(not(equals(parameters('ingressTransport'), 'tcp')), parameters('ingressAllowInsecure'), false()), 'customDomains', if(not(empty(parameters('customDomains'))), parameters('customDomains'), null()), 'corsPolicy', if(and(not(equals(parameters('corsPolicy'), null())), not(equals(parameters('ingressTransport'), 'tcp'))), createObject('allowCredentials', coalesce(tryGet(parameters('corsPolicy'), 'allowCredentials'), false()), 'allowedHeaders', coalesce(tryGet(parameters('corsPolicy'), 'allowedHeaders'), createArray()), 'allowedMethods', coalesce(tryGet(parameters('corsPolicy'), 'allowedMethods'), createArray()), 'allowedOrigins', coalesce(tryGet(parameters('corsPolicy'), 'allowedOrigins'), createArray()), 'exposeHeaders', coalesce(tryGet(parameters('corsPolicy'), 'exposeHeaders'), createArray()), 'maxAge', tryGet(parameters('corsPolicy'), 'maxAge')), null()), 'clientCertificateMode', if(not(equals(parameters('ingressTransport'), 'tcp')), parameters('clientCertificateMode'), null()), 'exposedPort', parameters('exposedPort'), 'external', parameters('ingressExternal'), 'ipSecurityRestrictions', if(not(empty(parameters('ipSecurityRestrictions'))), parameters('ipSecurityRestrictions'), null()), 'targetPort', parameters('ingressTargetPort'), 'stickySessions', createObject('affinity', parameters('stickySessionsAffinity')), 'traffic', if(not(equals(parameters('ingressTransport'), 'tcp')), createArray(createObject('label', parameters('trafficLabel'), 'latestRevision', parameters('trafficLatestRevision'), 'revisionName', parameters('trafficRevisionName'), 'weight', parameters('trafficWeight'))), null()), 'transport', parameters('ingressTransport')))]",
+                  "service": "[if(and(parameters('includeAddOns'), not(empty(parameters('service')))), parameters('service'), null())]",
+                  "maxInactiveRevisions": "[parameters('maxInactiveRevisions')]",
+                  "registries": "[if(not(empty(parameters('registries'))), parameters('registries'), null())]",
+                  "secrets": "[parameters('secrets')]",
+                  "runtime": {
+                    "dotnet": "[if(not(empty(tryGet(parameters('runtime'), 'dotnet'))), createObject('autoConfigureDataProtection', tryGet(parameters('runtime'), 'dotnet', 'autoConfigureDataProtection')), null())]",
+                    "java": "[if(not(empty(tryGet(parameters('runtime'), 'java'))), createObject('enableMetrics', tryGet(parameters('runtime'), 'java', 'enableMetrics'), 'javaAgent', createObject('enabled', tryGet(parameters('runtime'), 'java', 'enableJavaAgent'), 'logging', createObject('loggerSettings', tryGet(tryGet(parameters('runtime'), 'java'), 'loggerSettings')))), null())]"
+                  }
+                },
+                "template": {
+                  "containers": "[parameters('containers')]",
+                  "initContainers": "[if(not(empty(parameters('initContainersTemplate'))), parameters('initContainersTemplate'), null())]",
+                  "revisionSuffix": "[parameters('revisionSuffix')]",
+                  "scale": "[parameters('scaleSettings')]",
+                  "serviceBinds": "[if(and(parameters('includeAddOns'), not(empty(parameters('serviceBinds')))), parameters('serviceBinds'), null())]",
+                  "volumes": "[if(not(empty(parameters('volumes'))), parameters('volumes'), null())]"
+                },
+                "workloadProfileName": "[parameters('workloadProfileName')]"
+              }
+            },
+            "containerApp_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "containerApp"
+              ]
+            },
+            "containerApp_roleAssignments": {
+              "copy": {
+                "name": "containerApp_roleAssignments",
+                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.App/containerApps', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+              "properties": {
+                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "containerApp"
+              ]
+            }
+          },
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the Container App."
+              },
+              "value": "[resourceId('Microsoft.App/containerApps', parameters('name'))]"
+            },
+            "fqdn": {
+              "type": "string",
+              "metadata": {
+                "description": "The configuration of ingress fqdn."
+              },
+              "value": "[if(parameters('disableIngress'), 'IngressDisabled', reference('containerApp').configuration.ingress.fqdn)]"
+            },
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the resource group the Container App was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the Container App."
+              },
+              "value": "[parameters('name')]"
+            },
+            "systemAssignedMIPrincipalId": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "The principal ID of the system assigned identity."
+              },
+              "value": "[tryGet(tryGet(reference('containerApp', '2024-10-02-preview', 'full'), 'identity'), 'principalId')]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('containerApp', '2024-10-02-preview', 'full').location]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "aiFoundryProject",
+        "applicationInsights",
+        "containerAppEnvironment",
+        "userAssignedIdentity"
+      ]
+    },
+    "webServerFarm": {
+      "condition": "[variables('webServerFarmEnabled')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('avm.res.web.serverfarm.{0}', variables('webServerFarmResourceName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[variables('webServerFarmResourceName')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "location": {
+            "value": "[coalesce(tryGet(parameters('webServerFarmConfiguration'), 'location'), parameters('solutionLocation'))]"
+          },
+          "skuName": {
+            "value": "[coalesce(tryGet(parameters('webServerFarmConfiguration'), 'skuName'), 'P1v3')]"
+          },
+          "skuCapacity": {
+            "value": "[coalesce(tryGet(parameters('webServerFarmConfiguration'), 'skuCapacity'), 3)]"
+          },
+          "reserved": {
+            "value": true
+          },
+          "diagnosticSettings": {
+            "value": [
+              {
+                "workspaceResourceId": "[if(variables('useExistingWorkspace'), variables('existingWorkspaceResourceId'), listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId)]"
+              }
+            ]
+          },
+          "kind": {
+            "value": "linux"
+          },
+          "zoneRedundant": {
+            "value": false
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.32.4.45862",
+              "templateHash": "13070013363315850466"
+            },
+            "name": "App Service Plan",
+            "description": "This module deploys an App Service Plan.",
+            "owner": "Azure/module-maintainers"
+          },
+          "definitions": {
+            "diagnosticSettingMetricsOnlyType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of diagnostic setting."
+                  }
+                },
+                "metricCategories": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "category": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                        }
+                      },
+                      "enabled": {
+                        "type": "bool",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                  }
+                },
+                "logAnalyticsDestinationType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "AzureDiagnostics",
+                    "Dedicated"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                  }
+                },
+                "workspaceResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "storageAccountResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "eventHubAuthorizationRuleResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                  }
+                },
+                "eventHubName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "marketplacePartnerResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a diagnostic setting. To be used if only metrics are supported by the resource provider.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
+                }
+              }
+            },
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a lock.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
+                }
+              }
+            },
+            "roleAssignmentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                  }
+                },
+                "roleDefinitionIdOrName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                  }
+                },
+                "principalId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                  }
+                },
+                "principalType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Device",
+                    "ForeignGroup",
+                    "Group",
+                    "ServicePrincipal",
+                    "User"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The principal type of the assigned principal ID."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The description of the role assignment."
+                  }
+                },
+                "condition": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                  }
+                },
+                "conditionVersion": {
+                  "type": "string",
+                  "allowedValues": [
+                    "2.0"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Version of the condition."
+                  }
+                },
+                "delegatedManagedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a role assignment.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
+                }
+              }
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 60,
+              "metadata": {
+                "description": "Required. Name of the app service plan."
+              }
+            },
+            "skuName": {
+              "type": "string",
+              "defaultValue": "P1v3",
+              "metadata": {
+                "example": "  'F1'\n  'B1'\n  'P1v3'\n  'I1v2'\n  'FC1'\n  ",
+                "description": "Optional. The name of the SKU will Determine the tier, size, family of the App Service Plan. This defaults to P1v3 to leverage availability zones."
+              }
+            },
+            "skuCapacity": {
+              "type": "int",
+              "defaultValue": 3,
+              "metadata": {
+                "description": "Optional. Number of workers associated with the App Service Plan. This defaults to 3, to leverage availability zones."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all resources."
+              }
+            },
+            "kind": {
+              "type": "string",
+              "defaultValue": "app",
+              "allowedValues": [
+                "app",
+                "elastic",
+                "functionApp",
+                "windows",
+                "linux"
+              ],
+              "metadata": {
+                "description": "Optional. Kind of server OS."
+              }
+            },
+            "reserved": {
+              "type": "bool",
+              "defaultValue": "[equals(parameters('kind'), 'linux')]",
+              "metadata": {
+                "description": "Conditional. Defaults to false when creating Windows/app App Service Plan. Required if creating a Linux App Service Plan and must be set to true."
+              }
+            },
+            "appServiceEnvironmentId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. The Resource ID of the App Service Environment to use for the App Service Plan."
+              }
+            },
+            "workerTierName": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Target worker tier assigned to the App Service plan."
+              }
+            },
+            "perSiteScaling": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. If true, apps assigned to this App Service plan can be scaled independently. If false, apps assigned to this App Service plan will scale to all instances of the plan."
+              }
+            },
+            "elasticScaleEnabled": {
+              "type": "bool",
+              "defaultValue": "[greater(parameters('maximumElasticWorkerCount'), 1)]",
+              "metadata": {
+                "description": "Optional. Enable/Disable ElasticScaleEnabled App Service Plan."
+              }
+            },
+            "maximumElasticWorkerCount": {
+              "type": "int",
+              "defaultValue": 1,
+              "metadata": {
+                "description": "Optional. Maximum number of total workers allowed for this ElasticScaleEnabled App Service Plan."
+              }
+            },
+            "targetWorkerCount": {
+              "type": "int",
+              "defaultValue": 0,
+              "metadata": {
+                "description": "Optional. Scaling worker count."
+              }
+            },
+            "targetWorkerSize": {
+              "type": "int",
+              "defaultValue": 0,
+              "allowedValues": [
+                0,
+                1,
+                2
+              ],
+              "metadata": {
+                "description": "Optional. The instance size of the hosting plan (small, medium, or large)."
+              }
+            },
+            "zoneRedundant": {
+              "type": "bool",
+              "defaultValue": "[if(or(startsWith(parameters('skuName'), 'P'), startsWith(parameters('skuName'), 'EP')), true(), false())]",
+              "metadata": {
+                "description": "Optional. Zone Redundant server farms can only be used on Premium or ElasticPremium SKU tiers within ZRS Supported regions (https://learn.microsoft.com/en-us/azure/storage/common/redundancy-regions-zrs)."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "roleAssignments": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/roleAssignmentType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "diagnosticSettings": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/diagnosticSettingMetricsOnlyType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The diagnostic settings of the service."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "formattedRoleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+              }
+            ],
+            "builtInRoleNames": {
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+              "Web Plan Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b')]",
+              "Website Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'de139f84-1756-47ae-9be6-808fbbe84772')]"
+            }
+          },
+          "resources": {
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.web-serverfarm.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "appServicePlan": {
+              "type": "Microsoft.Web/serverfarms",
+              "apiVersion": "2022-09-01",
+              "name": "[parameters('name')]",
+              "kind": "[parameters('kind')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "sku": {
+                "name": "[parameters('skuName')]",
+                "capacity": "[if(equals(parameters('skuName'), 'FC1'), null(), parameters('skuCapacity'))]",
+                "tier": "[if(equals(parameters('skuName'), 'FC1'), 'FlexConsumption', null())]"
+              },
+              "properties": {
+                "workerTierName": "[parameters('workerTierName')]",
+                "hostingEnvironmentProfile": "[if(not(empty(parameters('appServiceEnvironmentId'))), createObject('id', parameters('appServiceEnvironmentId')), null())]",
+                "perSiteScaling": "[parameters('perSiteScaling')]",
+                "maximumElasticWorkerCount": "[parameters('maximumElasticWorkerCount')]",
+                "elasticScaleEnabled": "[parameters('elasticScaleEnabled')]",
+                "reserved": "[parameters('reserved')]",
+                "targetWorkerCount": "[parameters('targetWorkerCount')]",
+                "targetWorkerSizeId": "[parameters('targetWorkerSize')]",
+                "zoneRedundant": "[parameters('zoneRedundant')]"
+              }
+            },
+            "appServicePlan_diagnosticSettings": {
+              "copy": {
+                "name": "appServicePlan_diagnosticSettings",
+                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+              },
+              "type": "Microsoft.Insights/diagnosticSettings",
+              "apiVersion": "2021-05-01-preview",
+              "scope": "[format('Microsoft.Web/serverfarms/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "metrics",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                    "input": {
+                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                      "timeGrain": null
+                    }
+                  }
+                ],
+                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+              },
+              "dependsOn": [
+                "appServicePlan"
+              ]
+            },
+            "appServicePlan_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.Web/serverfarms/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "appServicePlan"
+              ]
+            },
+            "appServicePlan_roleAssignments": {
+              "copy": {
+                "name": "appServicePlan_roleAssignments",
+                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.Web/serverfarms/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Web/serverfarms', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+              "properties": {
+                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "appServicePlan"
+              ]
+            }
+          },
+          "outputs": {
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group the app service plan was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the app service plan."
+              },
+              "value": "[parameters('name')]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the app service plan."
+              },
+              "value": "[resourceId('Microsoft.Web/serverfarms', parameters('name'))]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('appServicePlan', '2022-09-01', 'full').location]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "logAnalyticsWorkspace"
+      ]
+    },
+    "webSite": {
+      "condition": "[variables('webSiteEnabled')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('avm.res.web.site.{0}', variables('webSiteName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[variables('webSiteName')]"
+          },
+          "tags": {
+            "value": "[coalesce(tryGet(parameters('webSiteConfiguration'), 'tags'), parameters('tags'))]"
+          },
+          "location": {
+            "value": "[coalesce(tryGet(parameters('webSiteConfiguration'), 'location'), parameters('solutionLocation'))]"
+          },
+          "kind": {
+            "value": "app,linux,container"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "serverFarmResourceId": {
+            "value": "[coalesce(tryGet(parameters('webSiteConfiguration'), 'environmentResourceId'), tryGet(reference('webServerFarm'), 'outputs').resourceId.value)]"
+          },
+          "appInsightResourceId": {
+            "value": "[reference('applicationInsights').outputs.resourceId.value]"
+          },
+          "diagnosticSettings": {
+            "value": [
+              {
+                "workspaceResourceId": "[if(variables('useExistingWorkspace'), variables('existingWorkspaceResourceId'), listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId)]"
+              }
+            ]
+          },
+          "publicNetworkAccess": {
+            "value": "Enabled"
+          },
+          "siteConfig": {
+            "value": {
+              "linuxFxVersion": "[format('DOCKER|{0}/{1}:{2}', coalesce(tryGet(parameters('webSiteConfiguration'), 'containerImageRegistryDomain'), 'biabcontainerreg.azurecr.io'), coalesce(tryGet(parameters('webSiteConfiguration'), 'containerImageName'), 'macaefrontend'), coalesce(tryGet(parameters('webSiteConfiguration'), 'containerImageTag'), 'latest'))]"
+            }
+          },
+          "appSettingsKeyValuePairs": {
+            "value": {
+              "SCM_DO_BUILD_DURING_DEPLOYMENT": "true",
+              "DOCKER_REGISTRY_SERVER_URL": "[format('https://{0}', coalesce(tryGet(parameters('webSiteConfiguration'), 'containerImageRegistryDomain'), 'biabcontainerreg.azurecr.io'))]",
+              "WEBSITES_PORT": "3000",
+              "WEBSITES_CONTAINER_START_TIME_LIMIT": "1800",
+              "BACKEND_API_URL": "[format('https://{0}', reference('containerApp').outputs.fqdn.value)]",
+              "AUTH_ENABLED": "false"
+            }
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.33.93.31351",
+              "templateHash": "2522527858358792357"
+            },
+            "name": "Web/Function Apps",
+            "description": "This module deploys a Web or Function App."
+          },
+          "definitions": {
+            "privateEndpointOutputType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "The name of the private endpoint."
+                  }
+                },
+                "resourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "The resource ID of the private endpoint."
+                  }
+                },
+                "groupId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "The group Id for the private endpoint Group."
+                  }
+                },
+                "customDnsConfigs": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "fqdn": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "FQDN that resolves to private endpoint IP address."
+                        }
+                      },
+                      "ipAddresses": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
+                        "metadata": {
+                          "description": "A list of private IP addresses of the private endpoint."
+                        }
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "The custom DNS configurations of the private endpoint."
+                  }
+                },
+                "networkInterfaceResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "metadata": {
+                    "description": "The IDs of the network interfaces associated with the private endpoint."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true
+              }
+            },
+            "_1.privateEndpointCustomDnsConfigType": {
+              "type": "object",
+              "properties": {
+                "fqdn": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                  }
+                },
+                "ipAddresses": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "metadata": {
+                    "description": "Required. A list of private IP addresses of the private endpoint."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointIpConfigurationType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the resource that is unique within a resource group."
+                  }
+                },
+                "properties": {
+                  "type": "object",
+                  "properties": {
+                    "groupId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                      }
+                    },
+                    "memberName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                      }
+                    },
+                    "privateIPAddress": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. Properties of private endpoint IP configurations."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointPrivateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "name": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The name of the private DNS Zone Group config."
+                        }
+                      },
+                      "privateDnsZoneResourceId": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The resource id of the private DNS zone."
+                        }
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "diagnosticSettingFullType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the diagnostic setting."
+                  }
+                },
+                "logCategoriesAndGroups": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "category": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                        }
+                      },
+                      "categoryGroup": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                        }
+                      },
+                      "enabled": {
+                        "type": "bool",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                  }
+                },
+                "metricCategories": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "category": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                        }
+                      },
+                      "enabled": {
+                        "type": "bool",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                  }
+                },
+                "logAnalyticsDestinationType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "AzureDiagnostics",
+                    "Dedicated"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                  }
+                },
+                "workspaceResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "storageAccountResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "eventHubAuthorizationRuleResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                  }
+                },
+                "eventHubName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                  }
+                },
+                "marketplacePartnerResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a lock.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "managedIdentityAllType": {
+              "type": "object",
+              "properties": {
+                "systemAssigned": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enables system assigned managed identity on the resource."
+                  }
+                },
+                "userAssignedResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "privateEndpointSingleServiceType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private Endpoint."
+                  }
+                },
+                "location": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The location to deploy the Private Endpoint to."
+                  }
+                },
+                "privateLinkServiceConnectionName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private link connection to create."
+                  }
+                },
+                "service": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                  }
+                },
+                "subnetResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                  }
+                },
+                "resourceGroupResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                  }
+                },
+                "privateDnsZoneGroup": {
+                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                  }
+                },
+                "isManualConnection": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. If Manual Private Link Connection is required."
+                  }
+                },
+                "manualConnectionRequestMessage": {
+                  "type": "string",
+                  "nullable": true,
+                  "maxLength": 140,
+                  "metadata": {
+                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                  }
+                },
+                "customDnsConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Custom DNS configurations."
+                  }
+                },
+                "ipConfigurations": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                  }
+                },
+                "applicationSecurityGroupResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                  }
+                },
+                "customNetworkInterfaceName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                  }
+                },
+                "lock": {
+                  "$ref": "#/definitions/lockType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                },
+                "roleAssignments": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/roleAssignmentType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Array of role assignments to create."
+                  }
+                },
+                "tags": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                  }
+                },
+                "enableTelemetry": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enable/Disable usage telemetry for module."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "roleAssignmentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                  }
+                },
+                "roleDefinitionIdOrName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                  }
+                },
+                "principalId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                  }
+                },
+                "principalType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Device",
+                    "ForeignGroup",
+                    "Group",
+                    "ServicePrincipal",
+                    "User"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The principal type of the assigned principal ID."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The description of the role assignment."
+                  }
+                },
+                "condition": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                  }
+                },
+                "conditionVersion": {
+                  "type": "string",
+                  "allowedValues": [
+                    "2.0"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Version of the condition."
+                  }
+                },
+                "delegatedManagedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a role assignment.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name of the site."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all Resources."
+              }
+            },
+            "kind": {
+              "type": "string",
+              "allowedValues": [
+                "functionapp",
+                "functionapp,linux",
+                "functionapp,workflowapp",
+                "functionapp,workflowapp,linux",
+                "functionapp,linux,container",
+                "functionapp,linux,container,azurecontainerapps",
+                "app,linux",
+                "app",
+                "linux,api",
+                "api",
+                "app,linux,container",
+                "app,container,windows"
+              ],
+              "metadata": {
+                "description": "Required. Type of site to deploy."
+              }
+            },
+            "serverFarmResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. The resource ID of the app service plan to use for the site."
+              }
+            },
+            "managedEnvironmentId": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Azure Resource Manager ID of the customers selected Managed Environment on which to host this app."
+              }
+            },
+            "httpsOnly": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Configures a site to accept only HTTPS requests. Issues redirect for HTTP requests."
+              }
+            },
+            "clientAffinityEnabled": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. If client affinity is enabled."
+              }
+            },
+            "appServiceEnvironmentResourceId": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The resource ID of the app service environment to use for this resource."
+              }
+            },
+            "managedIdentities": {
+              "$ref": "#/definitions/managedIdentityAllType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The managed identity definition for this resource."
+              }
+            },
+            "keyVaultAccessIdentityResourceId": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The resource ID of the assigned identity to be used to access a key vault with."
+              }
+            },
+            "storageAccountRequired": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Checks if Customer provided storage account is required."
+              }
+            },
+            "virtualNetworkSubnetId": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Azure Resource Manager ID of the Virtual network and subnet to be joined by Regional VNET Integration. This must be of the form /subscriptions/{subscriptionName}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}."
+              }
+            },
+            "vnetContentShareEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. To enable accessing content over virtual network."
+              }
+            },
+            "vnetImagePullEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. To enable pulling image over Virtual Network."
+              }
+            },
+            "vnetRouteAllEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Virtual Network Route All enabled. This causes all outbound traffic to have Virtual Network Security Groups and User Defined Routes applied."
+              }
+            },
+            "scmSiteAlsoStopped": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Stop SCM (KUDU) site when the app is stopped."
+              }
+            },
+            "siteConfig": {
+              "type": "object",
+              "defaultValue": {
+                "alwaysOn": true,
+                "minTlsVersion": "1.2",
+                "ftpsState": "FtpsOnly"
+              },
+              "metadata": {
+                "description": "Optional. The site config object. The defaults are set to the following values: alwaysOn: true, minTlsVersion: '1.2', ftpsState: 'FtpsOnly'."
+              }
+            },
+            "functionAppConfig": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The Function App configuration object."
+              }
+            },
+            "storageAccountResourceId": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
+              }
+            },
+            "storageAccountUseIdentityAuthentication": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
+              }
+            },
+            "webConfiguration": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The Site Config, Web settings to deploy."
+              }
+            },
+            "msDeployConfiguration": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The extension MSDeployment configuration."
+              }
+            },
+            "appInsightResourceId": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Resource ID of the app insight to leverage for this resource."
+              }
+            },
+            "appSettingsKeyValuePairs": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The app settings-value pairs except for AzureWebJobsStorage, AzureWebJobsDashboard, APPINSIGHTS_INSTRUMENTATIONKEY and APPLICATIONINSIGHTS_CONNECTION_STRING."
+              }
+            },
+            "authSettingV2Configuration": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The auth settings V2 configuration."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "logsConfiguration": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The logs settings configuration."
+              }
+            },
+            "privateEndpoints": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/privateEndpointSingleServiceType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+              }
+            },
+            "slots": {
+              "type": "array",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Configuration for deployment slots for an app."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "roleAssignments": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/roleAssignmentType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "diagnosticSettings": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/diagnosticSettingFullType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The diagnostic settings of the service."
+              }
+            },
+            "clientCertEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. To enable client certificate authentication (TLS mutual authentication)."
+              }
+            },
+            "clientCertExclusionPaths": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Client certificate authentication comma-separated exclusion paths."
+              }
+            },
+            "clientCertMode": {
+              "type": "string",
+              "defaultValue": "Optional",
+              "allowedValues": [
+                "Optional",
+                "OptionalInteractiveUser",
+                "Required"
+              ],
+              "metadata": {
+                "description": "Optional. This composes with ClientCertEnabled setting.\n- ClientCertEnabled=false means ClientCert is ignored.\n- ClientCertEnabled=true and ClientCertMode=Required means ClientCert is required.\n- ClientCertEnabled=true and ClientCertMode=Optional means ClientCert is optional or accepted.\n"
+              }
+            },
+            "cloningInfo": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. If specified during app creation, the app is cloned from a source app."
+              }
+            },
+            "containerSize": {
+              "type": "int",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Size of the function container."
+              }
+            },
+            "dailyMemoryTimeQuota": {
+              "type": "int",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Maximum allowed daily memory-time quota (applicable on dynamic apps only)."
+              }
+            },
+            "enabled": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Setting this value to false disables the app (takes the app offline)."
+              }
+            },
+            "hostNameSslStates": {
+              "type": "array",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Hostname SSL states are used to manage the SSL bindings for app's hostnames."
+              }
+            },
+            "hyperV": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Hyper-V sandbox."
+              }
+            },
+            "redundancyMode": {
+              "type": "string",
+              "defaultValue": "None",
+              "allowedValues": [
+                "ActiveActive",
+                "Failover",
+                "GeoRedundant",
+                "Manual",
+                "None"
+              ],
+              "metadata": {
+                "description": "Optional. Site redundancy mode."
+              }
+            },
+            "basicPublishingCredentialsPolicies": {
+              "type": "array",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The site publishing credential policy names which are associated with the sites."
+              }
+            },
+            "hybridConnectionRelays": {
+              "type": "array",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Names of hybrid connection relays to connect app with."
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "nullable": true,
+              "allowedValues": [
+                "Enabled",
+                "Disabled"
+              ],
+              "metadata": {
+                "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set."
+              }
+            },
+            "e2eEncryptionEnabled": {
+              "type": "bool",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. End to End Encryption Setting."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "formattedRoleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+              }
+            ],
+            "enableReferencedModulesTelemetry": false,
+            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+            "builtInRoleNames": {
+              "App Compliance Automation Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f37683f-2463-46b6-9ce7-9b788b988ba2')]",
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+              "Web Plan Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b')]",
+              "Website Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'de139f84-1756-47ae-9be6-808fbbe84772')]"
+            }
+          },
+          "resources": {
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.web-site.{0}.{1}', replace('0.15.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "app": {
+              "type": "Microsoft.Web/sites",
+              "apiVersion": "2024-04-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "kind": "[parameters('kind')]",
+              "tags": "[parameters('tags')]",
+              "identity": "[variables('identity')]",
+              "properties": {
+                "managedEnvironmentId": "[if(not(empty(parameters('managedEnvironmentId'))), parameters('managedEnvironmentId'), null())]",
+                "serverFarmId": "[parameters('serverFarmResourceId')]",
+                "clientAffinityEnabled": "[parameters('clientAffinityEnabled')]",
+                "httpsOnly": "[parameters('httpsOnly')]",
+                "hostingEnvironmentProfile": "[if(not(empty(parameters('appServiceEnvironmentResourceId'))), createObject('id', parameters('appServiceEnvironmentResourceId')), null())]",
+                "storageAccountRequired": "[parameters('storageAccountRequired')]",
+                "keyVaultReferenceIdentity": "[parameters('keyVaultAccessIdentityResourceId')]",
+                "virtualNetworkSubnetId": "[parameters('virtualNetworkSubnetId')]",
+                "siteConfig": "[parameters('siteConfig')]",
+                "functionAppConfig": "[parameters('functionAppConfig')]",
+                "clientCertEnabled": "[parameters('clientCertEnabled')]",
+                "clientCertExclusionPaths": "[parameters('clientCertExclusionPaths')]",
+                "clientCertMode": "[parameters('clientCertMode')]",
+                "cloningInfo": "[parameters('cloningInfo')]",
+                "containerSize": "[parameters('containerSize')]",
+                "dailyMemoryTimeQuota": "[parameters('dailyMemoryTimeQuota')]",
+                "enabled": "[parameters('enabled')]",
+                "hostNameSslStates": "[parameters('hostNameSslStates')]",
+                "hyperV": "[parameters('hyperV')]",
+                "redundancyMode": "[parameters('redundancyMode')]",
+                "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(not(empty(parameters('privateEndpoints'))), 'Disabled', 'Enabled'))]",
+                "vnetContentShareEnabled": "[parameters('vnetContentShareEnabled')]",
+                "vnetImagePullEnabled": "[parameters('vnetImagePullEnabled')]",
+                "vnetRouteAllEnabled": "[parameters('vnetRouteAllEnabled')]",
+                "scmSiteAlsoStopped": "[parameters('scmSiteAlsoStopped')]",
+                "endToEndEncryptionEnabled": "[parameters('e2eEncryptionEnabled')]"
+              }
+            },
+            "app_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.Web/sites/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "app"
+              ]
+            },
+            "app_diagnosticSettings": {
+              "copy": {
+                "name": "app_diagnosticSettings",
+                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+              },
+              "type": "Microsoft.Insights/diagnosticSettings",
+              "apiVersion": "2021-05-01-preview",
+              "scope": "[format('Microsoft.Web/sites/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "metrics",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                    "input": {
+                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                      "timeGrain": null
+                    }
+                  },
+                  {
+                    "name": "logs",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                    "input": {
+                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                    }
+                  }
+                ],
+                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+              },
+              "dependsOn": [
+                "app"
+              ]
+            },
+            "app_roleAssignments": {
+              "copy": {
+                "name": "app_roleAssignments",
+                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.Web/sites/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Web/sites', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+              "properties": {
+                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "app"
+              ]
+            },
+            "app_appsettings": {
+              "condition": "[or(or(not(empty(parameters('appSettingsKeyValuePairs'))), not(empty(parameters('appInsightResourceId')))), not(empty(parameters('storageAccountResourceId'))))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Site-Config-AppSettings', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "appName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "kind": {
+                    "value": "[parameters('kind')]"
+                  },
+                  "storageAccountResourceId": {
+                    "value": "[parameters('storageAccountResourceId')]"
+                  },
+                  "storageAccountUseIdentityAuthentication": {
+                    "value": "[parameters('storageAccountUseIdentityAuthentication')]"
+                  },
+                  "appInsightResourceId": {
+                    "value": "[parameters('appInsightResourceId')]"
+                  },
+                  "appSettingsKeyValuePairs": {
+                    "value": "[parameters('appSettingsKeyValuePairs')]"
+                  },
+                  "currentAppSettings": "[if(not(empty(resourceId('Microsoft.Web/sites', parameters('name')))), createObject('value', list(format('{0}/config/appsettings', resourceId('Microsoft.Web/sites', parameters('name'))), '2023-12-01').properties), createObject('value', createObject()))]"
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.33.93.31351",
+                      "templateHash": "12262977018813780856"
+                    },
+                    "name": "Site App Settings",
+                    "description": "This module deploys a Site App Setting."
+                  },
+                  "parameters": {
+                    "appName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "allowedValues": [
+                        "functionapp",
+                        "functionapp,linux",
+                        "functionapp,workflowapp",
+                        "functionapp,workflowapp,linux",
+                        "functionapp,linux,container",
+                        "functionapp,linux,container,azurecontainerapps",
+                        "app,linux",
+                        "app",
+                        "linux,api",
+                        "api",
+                        "app,linux,container",
+                        "app,container,windows"
+                      ],
+                      "metadata": {
+                        "description": "Required. Type of site to deploy."
+                      }
+                    },
+                    "storageAccountResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
+                      }
+                    },
+                    "storageAccountUseIdentityAuthentication": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
+                      }
+                    },
+                    "appInsightResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Resource ID of the app insight to leverage for this resource."
+                      }
+                    },
+                    "appSettingsKeyValuePairs": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The app settings key-value pairs except for AzureWebJobsStorage, AzureWebJobsDashboard, APPINSIGHTS_INSTRUMENTATIONKEY and APPLICATIONINSIGHTS_CONNECTION_STRING."
+                      }
+                    },
+                    "currentAppSettings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. The current app settings."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "app": {
+                      "existing": true,
+                      "type": "Microsoft.Web/sites",
+                      "apiVersion": "2023-12-01",
+                      "name": "[parameters('appName')]"
+                    },
+                    "appInsight": {
+                      "condition": "[not(empty(parameters('appInsightResourceId')))]",
+                      "existing": true,
+                      "type": "Microsoft.Insights/components",
+                      "apiVersion": "2020-02-02",
+                      "subscriptionId": "[split(parameters('appInsightResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(parameters('appInsightResourceId'), '/')[4]]",
+                      "name": "[last(split(parameters('appInsightResourceId'), '/'))]"
+                    },
+                    "storageAccount": {
+                      "condition": "[not(empty(parameters('storageAccountResourceId')))]",
+                      "existing": true,
+                      "type": "Microsoft.Storage/storageAccounts",
+                      "apiVersion": "2023-05-01",
+                      "subscriptionId": "[split(parameters('storageAccountResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(parameters('storageAccountResourceId'), '/')[4]]",
+                      "name": "[last(split(parameters('storageAccountResourceId'), '/'))]"
+                    },
+                    "appSettings": {
+                      "type": "Microsoft.Web/sites/config",
+                      "apiVersion": "2024-04-01",
+                      "name": "[format('{0}/{1}', parameters('appName'), 'appsettings')]",
+                      "kind": "[parameters('kind')]",
+                      "properties": "[union(coalesce(parameters('currentAppSettings'), createObject()), coalesce(parameters('appSettingsKeyValuePairs'), createObject()), if(and(not(empty(parameters('storageAccountResourceId'))), not(parameters('storageAccountUseIdentityAuthentication'))), createObject('AzureWebJobsStorage', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', last(split(parameters('storageAccountResourceId'), '/')), listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('storageAccountResourceId'), '/')[2], split(parameters('storageAccountResourceId'), '/')[4]), 'Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), '2023-05-01').keys[0].value, environment().suffixes.storage)), if(and(not(empty(parameters('storageAccountResourceId'))), parameters('storageAccountUseIdentityAuthentication')), union(createObject('AzureWebJobsStorage__accountName', last(split(parameters('storageAccountResourceId'), '/'))), createObject('AzureWebJobsStorage__blobServiceUri', reference('storageAccount').primaryEndpoints.blob), createObject('AzureWebJobsStorage__queueServiceUri', reference('storageAccount').primaryEndpoints.queue), createObject('AzureWebJobsStorage__tableServiceUri', reference('storageAccount').primaryEndpoints.table)), createObject())), if(not(empty(parameters('appInsightResourceId'))), createObject('APPLICATIONINSIGHTS_CONNECTION_STRING', reference('appInsight').ConnectionString), createObject()))]",
+                      "dependsOn": [
+                        "appInsight",
+                        "storageAccount"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the site config."
+                      },
+                      "value": "appsettings"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the site config."
+                      },
+                      "value": "[resourceId('Microsoft.Web/sites/config', parameters('appName'), 'appsettings')]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the site config was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "app"
+              ]
+            },
+            "app_authsettingsv2": {
+              "condition": "[not(empty(parameters('authSettingV2Configuration')))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Site-Config-AuthSettingsV2', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "appName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "kind": {
+                    "value": "[parameters('kind')]"
+                  },
+                  "authSettingV2Configuration": {
+                    "value": "[coalesce(parameters('authSettingV2Configuration'), createObject())]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.33.93.31351",
+                      "templateHash": "1129994114817101549"
+                    },
+                    "name": "Site Auth Settings V2 Config",
+                    "description": "This module deploys a Site Auth Settings V2 Configuration."
+                  },
+                  "parameters": {
+                    "appName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "allowedValues": [
+                        "functionapp",
+                        "functionapp,linux",
+                        "functionapp,workflowapp",
+                        "functionapp,workflowapp,linux",
+                        "functionapp,linux,container",
+                        "functionapp,linux,container,azurecontainerapps",
+                        "app,linux",
+                        "app",
+                        "linux,api",
+                        "api",
+                        "app,linux,container",
+                        "app,container,windows"
+                      ],
+                      "metadata": {
+                        "description": "Required. Type of site to deploy."
+                      }
+                    },
+                    "authSettingV2Configuration": {
+                      "type": "object",
+                      "metadata": {
+                        "description": "Required. The auth settings V2 configuration."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Web/sites/config",
+                      "apiVersion": "2024-04-01",
+                      "name": "[format('{0}/{1}', parameters('appName'), 'authsettingsV2')]",
+                      "kind": "[parameters('kind')]",
+                      "properties": "[parameters('authSettingV2Configuration')]"
+                    }
+                  ],
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the site config."
+                      },
+                      "value": "authsettingsV2"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the site config."
+                      },
+                      "value": "[resourceId('Microsoft.Web/sites/config', parameters('appName'), 'authsettingsV2')]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the site config was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "app"
+              ]
+            },
+            "app_logssettings": {
+              "condition": "[not(empty(coalesce(parameters('logsConfiguration'), createObject())))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Site-Config-Logs', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "appName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "logsConfiguration": {
+                    "value": "[parameters('logsConfiguration')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.33.93.31351",
+                      "templateHash": "17967336872376441757"
+                    },
+                    "name": "Site logs Config",
+                    "description": "This module deploys a Site logs Configuration."
+                  },
+                  "parameters": {
+                    "appName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the parent site resource."
+                      }
+                    },
+                    "logsConfiguration": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The logs settings configuration."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "app": {
+                      "existing": true,
+                      "type": "Microsoft.Web/sites",
+                      "apiVersion": "2024-04-01",
+                      "name": "[parameters('appName')]"
+                    },
+                    "webSettings": {
+                      "type": "Microsoft.Web/sites/config",
+                      "apiVersion": "2024-04-01",
+                      "name": "[format('{0}/{1}', parameters('appName'), 'logs')]",
+                      "kind": "string",
+                      "properties": "[parameters('logsConfiguration')]"
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the site config."
+                      },
+                      "value": "logs"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the site config."
+                      },
+                      "value": "[resourceId('Microsoft.Web/sites/config', parameters('appName'), 'logs')]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the site config was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "app",
+                "app_appsettings"
+              ]
+            },
+            "app_websettings": {
+              "condition": "[not(empty(coalesce(parameters('webConfiguration'), createObject())))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Site-Config-Web', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "appName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "webConfiguration": {
+                    "value": "[parameters('webConfiguration')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.33.93.31351",
+                      "templateHash": "15058680643544097487"
+                    },
+                    "name": "Site Web Config",
+                    "description": "This module deploys web settings configuration available under sites/config name: web."
+                  },
+                  "parameters": {
+                    "appName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the parent site resource."
+                      }
+                    },
+                    "webConfiguration": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The Site Config, Web settings to deploy."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "app": {
+                      "existing": true,
+                      "type": "Microsoft.Web/sites",
+                      "apiVersion": "2024-04-01",
+                      "name": "[parameters('appName')]"
+                    },
+                    "webSettings": {
+                      "type": "Microsoft.Web/sites/config",
+                      "apiVersion": "2024-04-01",
+                      "name": "[format('{0}/{1}', parameters('appName'), 'web')]",
+                      "kind": "string",
+                      "properties": "[parameters('webConfiguration')]"
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the site config."
+                      },
+                      "value": "web"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the site config."
+                      },
+                      "value": "[resourceId('Microsoft.Web/sites/config', parameters('appName'), 'web')]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the site config was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "app"
+              ]
+            },
+            "extension_msdeploy": {
+              "condition": "[not(empty(parameters('msDeployConfiguration')))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Site-Extension-MSDeploy', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "appName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "msDeployConfiguration": {
+                    "value": "[coalesce(parameters('msDeployConfiguration'), createObject())]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.33.93.31351",
+                      "templateHash": "14895622660217616811"
+                    },
+                    "name": "Site Deployment Extension ",
+                    "description": "This module deploys a Site extension for MSDeploy."
+                  },
+                  "parameters": {
+                    "appName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the parent site resource."
+                      }
+                    },
+                    "msDeployConfiguration": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Sets the MSDeployment Properties."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "app": {
+                      "existing": true,
+                      "type": "Microsoft.Web/sites",
+                      "apiVersion": "2024-04-01",
+                      "name": "[parameters('appName')]"
+                    },
+                    "msdeploy": {
+                      "type": "Microsoft.Web/sites/extensions",
+                      "apiVersion": "2024-04-01",
+                      "name": "[format('{0}/{1}', parameters('appName'), 'MSDeploy')]",
+                      "kind": "MSDeploy",
+                      "properties": "[parameters('msDeployConfiguration')]"
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the MSDeploy Package."
+                      },
+                      "value": "MSDeploy"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the Site Extension."
+                      },
+                      "value": "[resourceId('Microsoft.Web/sites/extensions', parameters('appName'), 'MSDeploy')]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the site config was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "app"
+              ]
+            },
+            "app_slots": {
+              "copy": {
+                "name": "app_slots",
+                "count": "[length(coalesce(parameters('slots'), createArray()))]",
+                "mode": "serial",
+                "batchSize": 1
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Slot-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('slots'), createArray())[copyIndex()].name)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[coalesce(parameters('slots'), createArray())[copyIndex()].name]"
+                  },
+                  "appName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "kind": {
+                    "value": "[parameters('kind')]"
+                  },
+                  "serverFarmResourceId": {
+                    "value": "[parameters('serverFarmResourceId')]"
+                  },
+                  "httpsOnly": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'httpsOnly'), parameters('httpsOnly'))]"
+                  },
+                  "appServiceEnvironmentResourceId": {
+                    "value": "[parameters('appServiceEnvironmentResourceId')]"
+                  },
+                  "clientAffinityEnabled": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientAffinityEnabled'), parameters('clientAffinityEnabled'))]"
+                  },
+                  "managedIdentities": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'managedIdentities'), parameters('managedIdentities'))]"
+                  },
+                  "keyVaultAccessIdentityResourceId": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'keyVaultAccessIdentityResourceId'), parameters('keyVaultAccessIdentityResourceId'))]"
+                  },
+                  "storageAccountRequired": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'storageAccountRequired'), parameters('storageAccountRequired'))]"
+                  },
+                  "virtualNetworkSubnetId": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'virtualNetworkSubnetId'), parameters('virtualNetworkSubnetId'))]"
+                  },
+                  "siteConfig": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'siteConfig'), parameters('siteConfig'))]"
+                  },
+                  "functionAppConfig": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'functionAppConfig'), parameters('functionAppConfig'))]"
+                  },
+                  "storageAccountResourceId": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'storageAccountResourceId'), parameters('storageAccountResourceId'))]"
+                  },
+                  "storageAccountUseIdentityAuthentication": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'storageAccountUseIdentityAuthentication'), parameters('storageAccountUseIdentityAuthentication'))]"
+                  },
+                  "appInsightResourceId": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'appInsightResourceId'), parameters('appInsightResourceId'))]"
+                  },
+                  "authSettingV2Configuration": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'authSettingV2Configuration'), parameters('authSettingV2Configuration'))]"
+                  },
+                  "msDeployConfiguration": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'msDeployConfiguration'), parameters('msDeployConfiguration'))]"
+                  },
+                  "diagnosticSettings": {
+                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'diagnosticSettings')]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'roleAssignments')]"
+                  },
+                  "appSettingsKeyValuePairs": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'appSettingsKeyValuePairs'), parameters('appSettingsKeyValuePairs'))]"
+                  },
+                  "basicPublishingCredentialsPolicies": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'basicPublishingCredentialsPolicies'), parameters('basicPublishingCredentialsPolicies'))]"
+                  },
+                  "lock": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                  },
+                  "privateEndpoints": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'privateEndpoints'), createArray())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                  },
+                  "clientCertEnabled": {
+                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientCertEnabled')]"
+                  },
+                  "clientCertExclusionPaths": {
+                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientCertExclusionPaths')]"
+                  },
+                  "clientCertMode": {
+                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientCertMode')]"
+                  },
+                  "cloningInfo": {
+                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'cloningInfo')]"
+                  },
+                  "containerSize": {
+                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'containerSize')]"
+                  },
+                  "customDomainVerificationId": {
+                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'customDomainVerificationId')]"
+                  },
+                  "dailyMemoryTimeQuota": {
+                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'dailyMemoryTimeQuota')]"
+                  },
+                  "enabled": {
+                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'enabled')]"
+                  },
+                  "hostNameSslStates": {
+                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hostNameSslStates')]"
+                  },
+                  "hyperV": {
+                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hyperV')]"
+                  },
+                  "publicNetworkAccess": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'publicNetworkAccess'), if(or(not(empty(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'privateEndpoints'))), not(empty(parameters('privateEndpoints')))), 'Disabled', 'Enabled'))]"
+                  },
+                  "redundancyMode": {
+                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'redundancyMode')]"
+                  },
+                  "vnetContentShareEnabled": {
+                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'vnetContentShareEnabled')]"
+                  },
+                  "vnetImagePullEnabled": {
+                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'vnetImagePullEnabled')]"
+                  },
+                  "vnetRouteAllEnabled": {
+                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'vnetRouteAllEnabled')]"
+                  },
+                  "hybridConnectionRelays": {
+                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hybridConnectionRelays')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.33.93.31351",
+                      "templateHash": "4067755327331248181"
+                    },
+                    "name": "Web/Function App Deployment Slots",
+                    "description": "This module deploys a Web or Function App Deployment Slot."
+                  },
+                  "definitions": {
+                    "privateEndpointOutputType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The name of the private endpoint."
+                          }
+                        },
+                        "resourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The resource ID of the private endpoint."
+                          }
+                        },
+                        "groupId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "The group Id for the private endpoint Group."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "fqdn": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "FQDN that resolves to private endpoint IP address."
+                                }
+                              },
+                              "ipAddresses": {
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                },
+                                "metadata": {
+                                  "description": "A list of private IP addresses of the private endpoint."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "The custom DNS configurations of the private endpoint."
+                          }
+                        },
+                        "networkInterfaceResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "The IDs of the network interfaces associated with the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "_1.privateEndpointCustomDnsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointIpConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointPrivateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "name": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                }
+                              },
+                              "privateDnsZoneResourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of the private DNS zone."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "diagnosticSettingFullType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "managedIdentityAllType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "privateEndpointSingleServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private Endpoint."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The location to deploy the Private Endpoint to."
+                          }
+                        },
+                        "privateLinkServiceConnectionName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private link connection to create."
+                          }
+                        },
+                        "service": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                          }
+                        },
+                        "subnetResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                          }
+                        },
+                        "resourceGroupResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                          }
+                        },
+                        "privateDnsZoneGroup": {
+                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                          }
+                        },
+                        "isManualConnection": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If Manual Private Link Connection is required."
+                          }
+                        },
+                        "manualConnectionRequestMessage": {
+                          "type": "string",
+                          "nullable": true,
+                          "maxLength": 140,
+                          "metadata": {
+                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Custom DNS configurations."
+                          }
+                        },
+                        "ipConfigurations": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                          }
+                        },
+                        "applicationSecurityGroupResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                          }
+                        },
+                        "customNetworkInterfaceName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                          }
+                        },
+                        "enableTelemetry": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable/Disable usage telemetry for module."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the slot."
+                      }
+                    },
+                    "appName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "allowedValues": [
+                        "functionapp",
+                        "functionapp,linux",
+                        "functionapp,workflowapp",
+                        "functionapp,workflowapp,linux",
+                        "functionapp,linux,container",
+                        "functionapp,linux,container,azurecontainerapps",
+                        "app,linux",
+                        "app",
+                        "linux,api",
+                        "api",
+                        "app,linux,container",
+                        "app,container,windows"
+                      ],
+                      "metadata": {
+                        "description": "Required. Type of site to deploy."
+                      }
+                    },
+                    "serverFarmResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resource ID of the app service plan to use for the slot."
+                      }
+                    },
+                    "httpsOnly": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Configures a slot to accept only HTTPS requests. Issues redirect for HTTP requests."
+                      }
+                    },
+                    "clientAffinityEnabled": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. If client affinity is enabled."
+                      }
+                    },
+                    "appServiceEnvironmentResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resource ID of the app service environment to use for this resource."
+                      }
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentityAllType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource."
+                      }
+                    },
+                    "keyVaultAccessIdentityResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resource ID of the assigned identity to be used to access a key vault with."
+                      }
+                    },
+                    "storageAccountRequired": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Checks if Customer provided storage account is required."
+                      }
+                    },
+                    "virtualNetworkSubnetId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Azure Resource Manager ID of the Virtual network and subnet to be joined by Regional VNET Integration. This must be of the form /subscriptions/{subscriptionName}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}."
+                      }
+                    },
+                    "siteConfig": {
+                      "type": "object",
+                      "defaultValue": {
+                        "alwaysOn": true
+                      },
+                      "metadata": {
+                        "description": "Optional. The site config object."
+                      }
+                    },
+                    "functionAppConfig": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The Function App config object."
+                      }
+                    },
+                    "storageAccountResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
+                      }
+                    },
+                    "storageAccountUseIdentityAuthentication": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
+                      }
+                    },
+                    "appInsightResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Resource ID of the app insight to leverage for this resource."
+                      }
+                    },
+                    "appSettingsKeyValuePairs": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The app settings-value pairs except for AzureWebJobsStorage, AzureWebJobsDashboard, APPINSIGHTS_INSTRUMENTATIONKEY and APPLICATIONINSIGHTS_CONNECTION_STRING."
+                      }
+                    },
+                    "authSettingV2Configuration": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The auth settings V2 configuration."
+                      }
+                    },
+                    "msDeployConfiguration": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The extension MSDeployment configuration."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointSingleServiceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration details for private endpoints."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingFullType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    },
+                    "clientCertEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. To enable client certificate authentication (TLS mutual authentication)."
+                      }
+                    },
+                    "clientCertExclusionPaths": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Client certificate authentication comma-separated exclusion paths."
+                      }
+                    },
+                    "clientCertMode": {
+                      "type": "string",
+                      "defaultValue": "Optional",
+                      "allowedValues": [
+                        "Optional",
+                        "OptionalInteractiveUser",
+                        "Required"
+                      ],
+                      "metadata": {
+                        "description": "Optional. This composes with ClientCertEnabled setting.</p>- ClientCertEnabled: false means ClientCert is ignored.</p>- ClientCertEnabled: true and ClientCertMode: Required means ClientCert is required.</p>- ClientCertEnabled: true and ClientCertMode: Optional means ClientCert is optional or accepted."
+                      }
+                    },
+                    "cloningInfo": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. If specified during app creation, the app is cloned from a source app."
+                      }
+                    },
+                    "containerSize": {
+                      "type": "int",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Size of the function container."
+                      }
+                    },
+                    "customDomainVerificationId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Unique identifier that verifies the custom domains assigned to the app. Customer will add this ID to a txt record for verification."
+                      }
+                    },
+                    "dailyMemoryTimeQuota": {
+                      "type": "int",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Maximum allowed daily memory-time quota (applicable on dynamic apps only)."
+                      }
+                    },
+                    "enabled": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Setting this value to false disables the app (takes the app offline)."
+                      }
+                    },
+                    "hostNameSslStates": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Hostname SSL states are used to manage the SSL bindings for app's hostnames."
+                      }
+                    },
+                    "hyperV": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Hyper-V sandbox."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "nullable": true,
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Allow or block all public traffic."
+                      }
+                    },
+                    "redundancyMode": {
+                      "type": "string",
+                      "defaultValue": "None",
+                      "allowedValues": [
+                        "ActiveActive",
+                        "Failover",
+                        "GeoRedundant",
+                        "Manual",
+                        "None"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Site redundancy mode."
+                      }
+                    },
+                    "basicPublishingCredentialsPolicies": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The site publishing credential policy names which are associated with the site slot."
+                      }
+                    },
+                    "vnetContentShareEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. To enable accessing content over virtual network."
+                      }
+                    },
+                    "vnetImagePullEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. To enable pulling image over Virtual Network."
+                      }
+                    },
+                    "vnetRouteAllEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Virtual Network Route All enabled. This causes all outbound traffic to have Virtual Network Security Groups and User Defined Routes applied."
+                      }
+                    },
+                    "hybridConnectionRelays": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Names of hybrid connection relays to connect app with."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "enableReferencedModulesTelemetry": false,
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInRoleNames": {
+                      "App Compliance Automation Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f37683f-2463-46b6-9ce7-9b788b988ba2')]",
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+                      "Web Plan Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b')]",
+                      "Website Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'de139f84-1756-47ae-9be6-808fbbe84772')]"
+                    }
+                  },
+                  "resources": {
+                    "app": {
+                      "existing": true,
+                      "type": "Microsoft.Web/sites",
+                      "apiVersion": "2024-04-01",
+                      "name": "[parameters('appName')]"
+                    },
+                    "slot": {
+                      "type": "Microsoft.Web/sites/slots",
+                      "apiVersion": "2024-04-01",
+                      "name": "[format('{0}/{1}', parameters('appName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "kind": "[parameters('kind')]",
+                      "tags": "[parameters('tags')]",
+                      "identity": "[variables('identity')]",
+                      "properties": {
+                        "serverFarmId": "[parameters('serverFarmResourceId')]",
+                        "clientAffinityEnabled": "[parameters('clientAffinityEnabled')]",
+                        "httpsOnly": "[parameters('httpsOnly')]",
+                        "hostingEnvironmentProfile": "[if(not(empty(parameters('appServiceEnvironmentResourceId'))), createObject('id', parameters('appServiceEnvironmentResourceId')), null())]",
+                        "storageAccountRequired": "[parameters('storageAccountRequired')]",
+                        "keyVaultReferenceIdentity": "[parameters('keyVaultAccessIdentityResourceId')]",
+                        "virtualNetworkSubnetId": "[parameters('virtualNetworkSubnetId')]",
+                        "siteConfig": "[parameters('siteConfig')]",
+                        "functionAppConfig": "[parameters('functionAppConfig')]",
+                        "clientCertEnabled": "[parameters('clientCertEnabled')]",
+                        "clientCertExclusionPaths": "[parameters('clientCertExclusionPaths')]",
+                        "clientCertMode": "[parameters('clientCertMode')]",
+                        "cloningInfo": "[parameters('cloningInfo')]",
+                        "containerSize": "[parameters('containerSize')]",
+                        "customDomainVerificationId": "[parameters('customDomainVerificationId')]",
+                        "dailyMemoryTimeQuota": "[parameters('dailyMemoryTimeQuota')]",
+                        "enabled": "[parameters('enabled')]",
+                        "hostNameSslStates": "[parameters('hostNameSslStates')]",
+                        "hyperV": "[parameters('hyperV')]",
+                        "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
+                        "redundancyMode": "[parameters('redundancyMode')]",
+                        "vnetContentShareEnabled": "[parameters('vnetContentShareEnabled')]",
+                        "vnetImagePullEnabled": "[parameters('vnetImagePullEnabled')]",
+                        "vnetRouteAllEnabled": "[parameters('vnetRouteAllEnabled')]"
+                      }
+                    },
+                    "slot_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Web/sites/{0}/slots/{1}', parameters('appName'), parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "slot"
+                      ]
+                    },
+                    "slot_diagnosticSettings": {
+                      "copy": {
+                        "name": "slot_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.Web/sites/{0}/slots/{1}', parameters('appName'), parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "slot"
+                      ]
+                    },
+                    "slot_roleAssignments": {
+                      "copy": {
+                        "name": "slot_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Web/sites/{0}/slots/{1}', parameters('appName'), parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "slot"
+                      ]
+                    },
+                    "slot_appsettings": {
+                      "condition": "[or(or(not(empty(parameters('appSettingsKeyValuePairs'))), not(empty(parameters('appInsightResourceId')))), not(empty(parameters('storageAccountResourceId'))))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Slot-{1}-Config-AppSettings', uniqueString(deployment().name, parameters('location')), parameters('name'))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "slotName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "appName": {
+                            "value": "[parameters('appName')]"
+                          },
+                          "kind": {
+                            "value": "[parameters('kind')]"
+                          },
+                          "storageAccountResourceId": {
+                            "value": "[parameters('storageAccountResourceId')]"
+                          },
+                          "storageAccountUseIdentityAuthentication": {
+                            "value": "[parameters('storageAccountUseIdentityAuthentication')]"
+                          },
+                          "appInsightResourceId": {
+                            "value": "[parameters('appInsightResourceId')]"
+                          },
+                          "appSettingsKeyValuePairs": {
+                            "value": "[parameters('appSettingsKeyValuePairs')]"
+                          },
+                          "currentAppSettings": "[if(not(empty(resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name')))), createObject('value', list(format('{0}/config/appsettings', resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))), '2023-12-01').properties), createObject('value', createObject()))]"
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.33.93.31351",
+                              "templateHash": "18192409627790392598"
+                            },
+                            "name": "Site Slot App Settings",
+                            "description": "This module deploys a Site Slot App Setting."
+                          },
+                          "parameters": {
+                            "slotName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Slot name to be configured."
+                              }
+                            },
+                            "appName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "kind": {
+                              "type": "string",
+                              "allowedValues": [
+                                "functionapp",
+                                "functionapp,linux",
+                                "functionapp,workflowapp",
+                                "functionapp,workflowapp,linux",
+                                "functionapp,linux,container",
+                                "functionapp,linux,container,azurecontainerapps",
+                                "app,linux",
+                                "app",
+                                "linux,api",
+                                "api",
+                                "app,linux,container",
+                                "app,container,windows"
+                              ],
+                              "metadata": {
+                                "description": "Required. Type of site to deploy."
+                              }
+                            },
+                            "storageAccountResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
+                              }
+                            },
+                            "storageAccountUseIdentityAuthentication": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
+                              }
+                            },
+                            "appInsightResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Resource ID of the app insight to leverage for this resource."
+                              }
+                            },
+                            "appSettingsKeyValuePairs": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The app settings key-value pairs except for AzureWebJobsStorage, AzureWebJobsDashboard, APPINSIGHTS_INSTRUMENTATIONKEY and APPLICATIONINSIGHTS_CONNECTION_STRING."
+                              }
+                            },
+                            "currentAppSettings": {
+                              "type": "object",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. The current app settings."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "app::slot": {
+                              "existing": true,
+                              "type": "Microsoft.Web/sites/slots",
+                              "apiVersion": "2024-04-01",
+                              "name": "[format('{0}/{1}', parameters('appName'), parameters('slotName'))]"
+                            },
+                            "app": {
+                              "existing": true,
+                              "type": "Microsoft.Web/sites",
+                              "apiVersion": "2024-04-01",
+                              "name": "[parameters('appName')]"
+                            },
+                            "appInsight": {
+                              "condition": "[not(empty(parameters('appInsightResourceId')))]",
+                              "existing": true,
+                              "type": "Microsoft.Insights/components",
+                              "apiVersion": "2020-02-02",
+                              "subscriptionId": "[split(parameters('appInsightResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(parameters('appInsightResourceId'), '/')[4]]",
+                              "name": "[last(split(parameters('appInsightResourceId'), '/'))]"
+                            },
+                            "storageAccount": {
+                              "condition": "[not(empty(parameters('storageAccountResourceId')))]",
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2023-05-01",
+                              "subscriptionId": "[split(parameters('storageAccountResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(parameters('storageAccountResourceId'), '/')[4]]",
+                              "name": "[last(split(parameters('storageAccountResourceId'), '/'))]"
+                            },
+                            "slotSettings": {
+                              "type": "Microsoft.Web/sites/slots/config",
+                              "apiVersion": "2024-04-01",
+                              "name": "[format('{0}/{1}/{2}', parameters('appName'), parameters('slotName'), 'appsettings')]",
+                              "kind": "[parameters('kind')]",
+                              "properties": "[union(coalesce(parameters('currentAppSettings'), createObject()), coalesce(parameters('appSettingsKeyValuePairs'), createObject()), if(and(not(empty(parameters('storageAccountResourceId'))), not(parameters('storageAccountUseIdentityAuthentication'))), createObject('AzureWebJobsStorage', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', last(split(parameters('storageAccountResourceId'), '/')), listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('storageAccountResourceId'), '/')[2], split(parameters('storageAccountResourceId'), '/')[4]), 'Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), '2023-05-01').keys[0].value, environment().suffixes.storage)), if(and(not(empty(parameters('storageAccountResourceId'))), parameters('storageAccountUseIdentityAuthentication')), union(createObject('AzureWebJobsStorage__accountName', last(split(parameters('storageAccountResourceId'), '/'))), createObject('AzureWebJobsStorage__blobServiceUri', reference('storageAccount').primaryEndpoints.blob)), createObject())), if(not(empty(parameters('appInsightResourceId'))), createObject('APPLICATIONINSIGHTS_CONNECTION_STRING', reference('appInsight').ConnectionString), createObject()))]",
+                              "dependsOn": [
+                                "appInsight",
+                                "storageAccount"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the slot config."
+                              },
+                              "value": "appsettings"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the slot config."
+                              },
+                              "value": "[resourceId('Microsoft.Web/sites/slots/config', parameters('appName'), parameters('slotName'), 'appsettings')]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the slot config was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "slot"
+                      ]
+                    },
+                    "slot_authsettingsv2": {
+                      "condition": "[not(empty(parameters('authSettingV2Configuration')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Slot-{1}-Config-AuthSettingsV2', uniqueString(deployment().name, parameters('location')), parameters('name'))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "slotName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "appName": {
+                            "value": "[parameters('appName')]"
+                          },
+                          "kind": {
+                            "value": "[parameters('kind')]"
+                          },
+                          "authSettingV2Configuration": {
+                            "value": "[coalesce(parameters('authSettingV2Configuration'), createObject())]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.33.93.31351",
+                              "templateHash": "4602741618711602070"
+                            },
+                            "name": "Site Slot Auth Settings V2 Config",
+                            "description": "This module deploys a Site Auth Settings V2 Configuration."
+                          },
+                          "parameters": {
+                            "appName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "slotName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Slot name to be configured."
+                              }
+                            },
+                            "kind": {
+                              "type": "string",
+                              "allowedValues": [
+                                "functionapp",
+                                "functionapp,linux",
+                                "functionapp,workflowapp",
+                                "functionapp,workflowapp,linux",
+                                "functionapp,linux,container",
+                                "functionapp,linux,container,azurecontainerapps",
+                                "app,linux",
+                                "app",
+                                "linux,api",
+                                "api",
+                                "app,linux,container",
+                                "app,container,windows"
+                              ],
+                              "metadata": {
+                                "description": "Required. Type of site to deploy."
+                              }
+                            },
+                            "authSettingV2Configuration": {
+                              "type": "object",
+                              "metadata": {
+                                "description": "Required. The auth settings V2 configuration."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.Web/sites/slots/config",
+                              "apiVersion": "2024-04-01",
+                              "name": "[format('{0}/{1}/{2}', parameters('appName'), parameters('slotName'), 'authsettingsV2')]",
+                              "kind": "[parameters('kind')]",
+                              "properties": "[parameters('authSettingV2Configuration')]"
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the slot config."
+                              },
+                              "value": "authsettingsV2"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the slot config."
+                              },
+                              "value": "[resourceId('Microsoft.Web/sites/slots/config', parameters('appName'), parameters('slotName'), 'authsettingsV2')]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the slot config was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "slot"
+                      ]
+                    },
+                    "slot_basicPublishingCredentialsPolicies": {
+                      "copy": {
+                        "name": "slot_basicPublishingCredentialsPolicies",
+                        "count": "[length(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Slot-Publish-Cred-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "appName": {
+                            "value": "[parameters('appName')]"
+                          },
+                          "slotName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()].name]"
+                          },
+                          "allow": {
+                            "value": "[tryGet(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()], 'allow')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.33.93.31351",
+                              "templateHash": "8803130402255189673"
+                            },
+                            "name": "Web Site Slot Basic Publishing Credentials Policies",
+                            "description": "This module deploys a Web Site Slot Basic Publishing Credentials Policy."
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "allowedValues": [
+                                "scm",
+                                "ftp"
+                              ],
+                              "metadata": {
+                                "description": "Required. The name of the resource."
+                              }
+                            },
+                            "allow": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Set to true to enable or false to disable a publishing method."
+                              }
+                            },
+                            "appName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "slotName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent web site slot. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.Web/sites/slots/basicPublishingCredentialsPolicies",
+                              "apiVersion": "2024-04-01",
+                              "name": "[format('{0}/{1}/{2}', parameters('appName'), parameters('slotName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "properties": {
+                                "allow": "[parameters('allow')]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the basic publishing credential policy."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the basic publishing credential policy."
+                              },
+                              "value": "[resourceId('Microsoft.Web/sites/slots/basicPublishingCredentialsPolicies', parameters('appName'), parameters('slotName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the basic publishing credential policy was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference(resourceId('Microsoft.Web/sites/slots/basicPublishingCredentialsPolicies', parameters('appName'), parameters('slotName'), parameters('name')), '2024-04-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "slot"
+                      ]
+                    },
+                    "slot_hybridConnectionRelays": {
+                      "copy": {
+                        "name": "slot_hybridConnectionRelays",
+                        "count": "[length(coalesce(parameters('hybridConnectionRelays'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Slot-HybridConnectionRelay-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "hybridConnectionResourceId": {
+                            "value": "[coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()].resourceId]"
+                          },
+                          "appName": {
+                            "value": "[parameters('appName')]"
+                          },
+                          "slotName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "sendKeyName": {
+                            "value": "[tryGet(coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()], 'sendKeyName')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.33.93.31351",
+                              "templateHash": "16445776675656358479"
+                            },
+                            "name": "Web/Function Apps Slot Hybrid Connection Relay",
+                            "description": "This module deploys a Site Slot Hybrid Connection Namespace Relay."
+                          },
+                          "parameters": {
+                            "hybridConnectionResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The resource ID of the relay namespace hybrid connection."
+                              }
+                            },
+                            "slotName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the site slot. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "appName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "sendKeyName": {
+                              "type": "string",
+                              "defaultValue": "defaultSender",
+                              "metadata": {
+                                "description": "Optional. Name of the authorization rule send key to use."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.Web/sites/slots/hybridConnectionNamespaces/relays",
+                              "apiVersion": "2024-04-01",
+                              "name": "[format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
+                              "properties": {
+                                "serviceBusNamespace": "[split(parameters('hybridConnectionResourceId'), '/')[8]]",
+                                "serviceBusSuffix": "[split(substring(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2021-11-01').serviceBusEndpoint, indexOf(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2021-11-01').serviceBusEndpoint, '.servicebus')), ':')[0]]",
+                                "relayName": "[split(parameters('hybridConnectionResourceId'), '/')[10]]",
+                                "relayArmUri": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
+                                "hostname": "[split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2021-11-01').userMetadata)[0].value, ':')[0]]",
+                                "port": "[int(split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2021-11-01').userMetadata)[0].value, ':')[1])]",
+                                "sendKeyName": "[parameters('sendKeyName')]",
+                                "sendKeyValue": "[listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections/authorizationRules', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10], parameters('sendKeyName')), '2021-11-01').primaryKey]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the hybrid connection relay.."
+                              },
+                              "value": "[format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the hybrid connection relay."
+                              },
+                              "value": "[resourceId('Microsoft.Web/sites/slots/hybridConnectionNamespaces/relays', split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[0], split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[1], split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[2], split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[3])]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the resource was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "slot"
+                      ]
+                    },
+                    "slot_extensionMSdeploy": {
+                      "condition": "[not(empty(parameters('msDeployConfiguration')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Site-Extension-MSDeploy', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "appName": {
+                            "value": "[parameters('appName')]"
+                          },
+                          "msDeployConfiguration": {
+                            "value": "[coalesce(parameters('msDeployConfiguration'), createObject())]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.33.93.31351",
+                              "templateHash": "14895622660217616811"
+                            },
+                            "name": "Site Deployment Extension ",
+                            "description": "This module deploys a Site extension for MSDeploy."
+                          },
+                          "parameters": {
+                            "appName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the parent site resource."
+                              }
+                            },
+                            "msDeployConfiguration": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Sets the MSDeployment Properties."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "app": {
+                              "existing": true,
+                              "type": "Microsoft.Web/sites",
+                              "apiVersion": "2024-04-01",
+                              "name": "[parameters('appName')]"
+                            },
+                            "msdeploy": {
+                              "type": "Microsoft.Web/sites/extensions",
+                              "apiVersion": "2024-04-01",
+                              "name": "[format('{0}/{1}', parameters('appName'), 'MSDeploy')]",
+                              "kind": "MSDeploy",
+                              "properties": "[parameters('msDeployConfiguration')]"
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the MSDeploy Package."
+                              },
+                              "value": "MSDeploy"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the Site Extension."
+                              },
+                              "value": "[resourceId('Microsoft.Web/sites/extensions', parameters('appName'), 'MSDeploy')]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the site config was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "slot_privateEndpoints": {
+                      "copy": {
+                        "name": "slot_privateEndpoints",
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-slot-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('appName')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name'))), copyIndex()))]"
+                          },
+                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('appName')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name'))), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('appName')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name')))))))), createObject('value', null()))]",
+                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('appName')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name'))), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('appName')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name')))), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                          "subnetResourceId": {
+                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          },
+                          "location": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                          },
+                          "lock": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                          },
+                          "privateDnsZoneGroup": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "customDnsConfigs": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                          },
+                          "ipConfigurations": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                          },
+                          "applicationSecurityGroupResourceIds": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                          },
+                          "customNetworkInterfaceName": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.33.13.18514",
+                              "templateHash": "15954548978129725136"
+                            },
+                            "name": "Private Endpoints",
+                            "description": "This module deploys a Private Endpoint."
+                          },
+                          "definitions": {
+                            "privateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "ipConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the resource that is unique within a resource group."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "groupId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                                      }
+                                    },
+                                    "memberName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                                      }
+                                    },
+                                    "privateIPAddress": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Properties of private endpoint IP configurations."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "privateLinkServiceConnectionType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the private link service connection."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "groupIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "metadata": {
+                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
+                                      }
+                                    },
+                                    "privateLinkServiceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The resource id of private link service."
+                                      }
+                                    },
+                                    "requestMessage": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Properties of private link service connection."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "customDnsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "fqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                  }
+                                },
+                                "ipAddresses": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of private IP addresses of the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            },
+                            "privateDnsZoneGroupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private DNS zone group config."
+                                  }
+                                },
+                                "privateDnsZoneResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource id of the private DNS zone."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the private endpoint resource to create."
+                              }
+                            },
+                            "subnetResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                              }
+                            },
+                            "applicationSecurityGroupResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                              }
+                            },
+                            "customNetworkInterfaceName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                              }
+                            },
+                            "ipConfigurations": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/ipConfigurationType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                              }
+                            },
+                            "privateDnsZoneGroup": {
+                              "$ref": "#/definitions/privateDnsZoneGroupType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                              }
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/customDnsConfigType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Custom DNS configurations."
+                              }
+                            },
+                            "manualPrivateLinkServiceConnections": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateLinkServiceConnectionType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                              }
+                            },
+                            "privateLinkServiceConnections": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateLinkServiceConnectionType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.10.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateEndpoint": {
+                              "type": "Microsoft.Network/privateEndpoints",
+                              "apiVersion": "2023-11-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "applicationSecurityGroups",
+                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                    "input": {
+                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                    }
+                                  }
+                                ],
+                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                "subnet": {
+                                  "id": "[parameters('subnetResourceId')]"
+                                }
+                              }
+                            },
+                            "privateEndpoint_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_roleAssignments": {
+                              "copy": {
+                                "name": "privateEndpoint_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_privateDnsZoneGroup": {
+                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                  },
+                                  "privateEndpointName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "privateDnsZoneConfigs": {
+                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.33.13.18514",
+                                      "templateHash": "5440815542537978381"
+                                    },
+                                    "name": "Private Endpoint Private DNS Zone Groups",
+                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateEndpointName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "privateDnsZoneConfigs": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                      },
+                                      "minLength": 1,
+                                      "maxLength": 5,
+                                      "metadata": {
+                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "default",
+                                      "metadata": {
+                                        "description": "Optional. The name of the private DNS zone group."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "privateDnsZoneConfigsVar",
+                                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                        "input": {
+                                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
+                                          "properties": {
+                                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
+                                          }
+                                        }
+                                      }
+                                    ]
+                                  },
+                                  "resources": {
+                                    "privateEndpoint": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2023-11-01",
+                                      "name": "[parameters('privateEndpointName')]"
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                      "apiVersion": "2023-11-01",
+                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                      "properties": {
+                                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private endpoint was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private endpoint."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private endpoint."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('privateEndpoint', '2023-11-01', 'full').location]"
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/customDnsConfigType"
+                              },
+                              "metadata": {
+                                "description": "The custom DNS configurations of the private endpoint."
+                              },
+                              "value": "[reference('privateEndpoint').customDnsConfigs]"
+                            },
+                            "networkInterfaceResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "metadata": {
+                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                              },
+                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                            },
+                            "groupId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The group Id for the private endpoint Group."
+                              },
+                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "slot"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the slot."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the slot."
+                      },
+                      "value": "[resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the slot was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[tryGet(tryGet(reference('slot', '2024-04-01', 'full'), 'identity'), 'principalId')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('slot', '2024-04-01', 'full').location]"
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointOutputType"
+                      },
+                      "metadata": {
+                        "description": "The private endpoints of the slot."
+                      },
+                      "copy": {
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                        "input": {
+                          "name": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                          "resourceId": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                          "groupId": "[tryGet(tryGet(reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                          "customDnsConfigs": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                          "networkInterfaceResourceIds": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                        }
+                      }
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "app"
+              ]
+            },
+            "app_basicPublishingCredentialsPolicies": {
+              "copy": {
+                "name": "app_basicPublishingCredentialsPolicies",
+                "count": "[length(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Site-Publish-Cred-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "webAppName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()].name]"
+                  },
+                  "allow": {
+                    "value": "[tryGet(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()], 'allow')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.33.93.31351",
+                      "templateHash": "7001118912896436334"
+                    },
+                    "name": "Web Site Basic Publishing Credentials Policies",
+                    "description": "This module deploys a Web Site Basic Publishing Credentials Policy."
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "allowedValues": [
+                        "scm",
+                        "ftp"
+                      ],
+                      "metadata": {
+                        "description": "Required. The name of the resource."
+                      }
+                    },
+                    "allow": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Set to true to enable or false to disable a publishing method."
+                      }
+                    },
+                    "webAppName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies",
+                      "apiVersion": "2024-04-01",
+                      "name": "[format('{0}/{1}', parameters('webAppName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "properties": {
+                        "allow": "[parameters('allow')]"
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the basic publishing credential policy."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the basic publishing credential policy."
+                      },
+                      "value": "[resourceId('Microsoft.Web/sites/basicPublishingCredentialsPolicies', parameters('webAppName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the basic publishing credential policy was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Web/sites/basicPublishingCredentialsPolicies', parameters('webAppName'), parameters('name')), '2024-04-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "app"
+              ]
+            },
+            "app_hybridConnectionRelays": {
+              "copy": {
+                "name": "app_hybridConnectionRelays",
+                "count": "[length(coalesce(parameters('hybridConnectionRelays'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-HybridConnectionRelay-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "hybridConnectionResourceId": {
+                    "value": "[coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()].resourceId]"
+                  },
+                  "appName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "sendKeyName": {
+                    "value": "[tryGet(coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()], 'sendKeyName')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.33.93.31351",
+                      "templateHash": "13214417392638890300"
+                    },
+                    "name": "Web/Function Apps Hybrid Connection Relay",
+                    "description": "This module deploys a Site Hybrid Connection Namespace Relay."
+                  },
+                  "parameters": {
+                    "hybridConnectionResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource ID of the relay namespace hybrid connection."
+                      }
+                    },
+                    "appName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "sendKeyName": {
+                      "type": "string",
+                      "defaultValue": "defaultSender",
+                      "metadata": {
+                        "description": "Optional. Name of the authorization rule send key to use."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Web/sites/hybridConnectionNamespaces/relays",
+                      "apiVersion": "2024-04-01",
+                      "name": "[format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
+                      "properties": {
+                        "serviceBusNamespace": "[split(parameters('hybridConnectionResourceId'), '/')[8]]",
+                        "serviceBusSuffix": "[split(substring(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2021-11-01').serviceBusEndpoint, indexOf(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2021-11-01').serviceBusEndpoint, '.servicebus')), ':')[0]]",
+                        "relayName": "[split(parameters('hybridConnectionResourceId'), '/')[10]]",
+                        "relayArmUri": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
+                        "hostname": "[split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2021-11-01').userMetadata)[0].value, ':')[0]]",
+                        "port": "[int(split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2021-11-01').userMetadata)[0].value, ':')[1])]",
+                        "sendKeyName": "[parameters('sendKeyName')]",
+                        "sendKeyValue": "[listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections/authorizationRules', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10], parameters('sendKeyName')), '2021-11-01').primaryKey]"
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the hybrid connection relay.."
+                      },
+                      "value": "[format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the hybrid connection relay."
+                      },
+                      "value": "[resourceId('Microsoft.Web/sites/hybridConnectionNamespaces/relays', split(format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[0], split(format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[1], split(format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[2])]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the resource was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "app"
+              ]
+            },
+            "app_privateEndpoints": {
+              "copy": {
+                "name": "app_privateEndpoints",
+                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-app-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+              "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites'), copyIndex()))]"
+                  },
+                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites')))))), createObject('value', null()))]",
+                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                  "subnetResourceId": {
+                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                  },
+                  "location": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                  },
+                  "lock": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                  },
+                  "privateDnsZoneGroup": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                  },
+                  "customDnsConfigs": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                  },
+                  "ipConfigurations": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                  },
+                  "applicationSecurityGroupResourceIds": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                  },
+                  "customNetworkInterfaceName": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.33.13.18514",
+                      "templateHash": "15954548978129725136"
+                    },
+                    "name": "Private Endpoints",
+                    "description": "This module deploys a Private Endpoint."
+                  },
+                  "definitions": {
+                    "privateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "ipConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "privateLinkServiceConnectionType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the private link service connection."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
+                              }
+                            },
+                            "privateLinkServiceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The resource id of private link service."
+                              }
+                            },
+                            "requestMessage": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private link service connection."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "customDnsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "private-dns-zone-group/main.bicep"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the private endpoint resource to create."
+                      }
+                    },
+                    "subnetResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                      }
+                    },
+                    "applicationSecurityGroupResourceIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                      }
+                    },
+                    "customNetworkInterfaceName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                      }
+                    },
+                    "ipConfigurations": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/ipConfigurationType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                      }
+                    },
+                    "privateDnsZoneGroup": {
+                      "$ref": "#/definitions/privateDnsZoneGroupType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                      }
+                    },
+                    "customDnsConfigs": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/customDnsConfigType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Custom DNS configurations."
+                      }
+                    },
+                    "manualPrivateLinkServiceConnections": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateLinkServiceConnectionType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                      }
+                    },
+                    "privateLinkServiceConnections": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateLinkServiceConnectionType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.10.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "privateEndpoint": {
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "applicationSecurityGroups",
+                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                            "input": {
+                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                            }
+                          }
+                        ],
+                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                        "subnet": {
+                          "id": "[parameters('subnetResourceId')]"
+                        }
+                      }
+                    },
+                    "privateEndpoint_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    },
+                    "privateEndpoint_roleAssignments": {
+                      "copy": {
+                        "name": "privateEndpoint_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    },
+                    "privateEndpoint_privateDnsZoneGroup": {
+                      "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                          },
+                          "privateEndpointName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "privateDnsZoneConfigs": {
+                            "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.33.13.18514",
+                              "templateHash": "5440815542537978381"
+                            },
+                            "name": "Private Endpoint Private DNS Zone Groups",
+                            "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                          },
+                          "definitions": {
+                            "privateDnsZoneGroupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private DNS zone group config."
+                                  }
+                                },
+                                "privateDnsZoneResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource id of the private DNS zone."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "privateEndpointName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "privateDnsZoneConfigs": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                              },
+                              "minLength": 1,
+                              "maxLength": 5,
+                              "metadata": {
+                                "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "default",
+                              "metadata": {
+                                "description": "Optional. The name of the private DNS zone group."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "privateDnsZoneConfigsVar",
+                                "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                "input": {
+                                  "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
+                                  "properties": {
+                                    "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
+                                  }
+                                }
+                              }
+                            ]
+                          },
+                          "resources": {
+                            "privateEndpoint": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateEndpoints",
+                              "apiVersion": "2023-11-01",
+                              "name": "[parameters('privateEndpointName')]"
+                            },
+                            "privateDnsZoneGroup": {
+                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                              "apiVersion": "2023-11-01",
+                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                              "properties": {
+                                "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private endpoint DNS zone group."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private endpoint DNS zone group."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private endpoint DNS zone group was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the private endpoint was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the private endpoint."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the private endpoint."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('privateEndpoint', '2023-11-01', 'full').location]"
+                    },
+                    "customDnsConfigs": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/customDnsConfigType"
+                      },
+                      "metadata": {
+                        "description": "The custom DNS configurations of the private endpoint."
+                      },
+                      "value": "[reference('privateEndpoint').customDnsConfigs]"
+                    },
+                    "networkInterfaceResourceIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "metadata": {
+                        "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                      },
+                      "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                    },
+                    "groupId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The group Id for the private endpoint Group."
+                      },
+                      "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "app"
+              ]
+            }
+          },
+          "outputs": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the site."
+              },
+              "value": "[parameters('name')]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the site."
+              },
+              "value": "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+            },
+            "slots": {
+              "type": "array",
+              "metadata": {
+                "description": "The list of the slots."
+              },
+              "copy": {
+                "count": "[length(coalesce(parameters('slots'), createArray()))]",
+                "input": "[format('{0}-Slot-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('slots'), createArray())[copyIndex()].name)]"
+              }
+            },
+            "slotResourceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The list of the slot resource ids."
+              },
+              "copy": {
+                "count": "[length(coalesce(parameters('slots'), createArray()))]",
+                "input": "[reference(format('app_slots[{0}]', copyIndex())).outputs.resourceId.value]"
+              }
+            },
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group the site was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "systemAssignedMIPrincipalId": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "The principal ID of the system assigned identity."
+              },
+              "value": "[tryGet(tryGet(reference('app', '2024-04-01', 'full'), 'identity'), 'principalId')]"
+            },
+            "slotSystemAssignedMIPrincipalIds": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "metadata": {
+                "description": "The principal ID of the system assigned identity of slots."
+              },
+              "copy": {
+                "count": "[length(coalesce(parameters('slots'), createArray()))]",
+                "input": "[coalesce(tryGet(tryGet(reference(format('app_slots[{0}]', copyIndex())).outputs, 'systemAssignedMIPrincipalId'), 'value'), '')]"
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('app', '2024-04-01', 'full').location]"
+            },
+            "defaultHostname": {
+              "type": "string",
+              "metadata": {
+                "description": "Default hostname of the app."
+              },
+              "value": "[reference('app').defaultHostName]"
+            },
+            "customDomainVerificationId": {
+              "type": "string",
+              "metadata": {
+                "description": "Unique identifier that verifies the custom domains assigned to the app. Customer will add this ID to a txt record for verification."
+              },
+              "value": "[reference('app').customDomainVerificationId]"
+            },
+            "privateEndpoints": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/privateEndpointOutputType"
+              },
+              "metadata": {
+                "description": "The private endpoints of the site."
+              },
+              "copy": {
+                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                "input": {
+                  "name": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                  "resourceId": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                  "groupId": "[tryGet(tryGet(reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                  "customDnsConfigs": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                  "networkInterfaceResourceIds": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                }
+              }
+            },
+            "slotPrivateEndpoints": {
+              "type": "array",
+              "metadata": {
+                "description": "The private endpoints of the slots."
+              },
+              "copy": {
+                "count": "[length(coalesce(parameters('slots'), createArray()))]",
+                "input": "[reference(format('app_slots[{0}]', copyIndex())).outputs.privateEndpoints.value]"
+              }
+            },
+            "outboundIpAddresses": {
+              "type": "string",
+              "metadata": {
+                "description": "The outbound IP addresses of the app."
+              },
+              "value": "[reference('app').outboundIpAddresses]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "applicationInsights",
+        "containerApp",
+        "logAnalyticsWorkspace",
+        "webServerFarm"
+      ]
+    }
+  },
+  "outputs": {
+    "webSiteDefaultHostname": {
+      "type": "string",
+      "metadata": {
+        "description": "The default url of the website to connect to the Multi-Agent Custom Automation Engine solution."
+      },
+      "value": "[reference('webSite').outputs.defaultHostname.value]"
+    }
+  }
+}
\ No newline at end of file

From 78432fec7d1013050fddfb4ffa0aa53f87928fec Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Mon, 7 Jul 2025 15:57:41 +0530
Subject: [PATCH 11/70] edit

---
 .github/workflows/deploy.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index f594c9eb4..2defff1ea 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -140,8 +140,7 @@ jobs:
                 modelDeploymentType="GlobalStandard" \
                 gptModelName="gpt-4o" \
                 gptModelVersion="2024-08-06" \
-                imageTag="${IMAGE_TAG}" \
-                gptdeploymentCapacity="${{env.GPT_MIN_CAPACITY}}"
+                imageTag="${IMAGE_TAG}"
 
       - name: Extract Web App and API App URLs
         id: get_output # <-- Add this

From 9936f27825ab294d60d187dbe94fd008d70444cb Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Tue, 8 Jul 2025 11:00:06 +0530
Subject: [PATCH 12/70] edit

---
 .github/workflows/deploy.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 2defff1ea..d0b35f61b 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -140,7 +140,9 @@ jobs:
                 modelDeploymentType="GlobalStandard" \
                 gptModelName="gpt-4o" \
                 gptModelVersion="2024-08-06" \
-                imageTag="${IMAGE_TAG}"
+                imageTag="${IMAGE_TAG}" \
+              --output json \
+              --debug
 
       - name: Extract Web App and API App URLs
         id: get_output # <-- Add this

From 2d5d44752147222c0c7c574878da4216ecde59ef Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Tue, 8 Jul 2025 12:43:36 +0530
Subject: [PATCH 13/70] edit

---
 .github/workflows/deploy.yml          | 1 +
 .github/workflows/test-automation.yml | 8 ++++++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index d0b35f61b..ed0f85338 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -202,6 +202,7 @@ jobs:
     with:
       MACAE_WEB_URL: ${{ needs.deploy.outputs.WEBAPP_URL }}
       MACAE_URL_API: ${{ needs.deploy.outputs.API_APP_URL }}
+      MACAE_CONTAINER_APP: ${{needs.deploy.outputs.SOLUTION_PREFIX}}
     secrets: inherit
   cleanup-deployment:
     if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index db66cb864..61dda7dec 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -5,6 +5,7 @@ on:
     branches:
       - main
       - dev
+      - hotfix
     paths:
       - "tests/e2e-test/**"
   schedule:
@@ -55,7 +56,10 @@ jobs:
         with:
           azcliversion: "latest"
           inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ vars.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ vars.MACAE_BACKEND_CONTAINER_NAME }}/start?api-version=2025-01-01"
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.RESOURCE_GROUP_NAME }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/start?api-version=2025-01-01"
+            echo "subscriptions:${secrets.AZURE_SUBSCRIPTION_ID}"
+            echo "rg:${env.RESOURCE_GROUP_NAME }"
+            echo "containerapp:${ env.MACAE_CONTAINER_APP }"
 
       - name: Install dependencies
         run: |
@@ -187,5 +191,5 @@ jobs:
         with:
           azcliversion: "latest"
           inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ vars.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ vars.MACAE_BACKEND_CONTAINER_NAME }}/stop?api-version=2025-01-01"
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.RESOURCE_GROUP_NAME }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP  }}/stop?api-version=2025-01-01"
             az logout

From b2de79b9edbc77a25afb80cf0a8ef330f2c680c2 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Tue, 8 Jul 2025 15:53:42 +0530
Subject: [PATCH 14/70] edit

---
 .github/workflows/deploy.yml          | 2 +-
 .github/workflows/test-automation.yml | 7 ++-----
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index ed0f85338..87404ab6f 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -202,7 +202,7 @@ jobs:
     with:
       MACAE_WEB_URL: ${{ needs.deploy.outputs.WEBAPP_URL }}
       MACAE_URL_API: ${{ needs.deploy.outputs.API_APP_URL }}
-      MACAE_CONTAINER_APP: ${{needs.deploy.outputs.SOLUTION_PREFIX}}
+
     secrets: inherit
   cleanup-deployment:
     if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index 61dda7dec..2f0ff4a2d 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -56,10 +56,7 @@ jobs:
         with:
           azcliversion: "latest"
           inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.RESOURCE_GROUP_NAME }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/start?api-version=2025-01-01"
-            echo "subscriptions:${secrets.AZURE_SUBSCRIPTION_ID}"
-            echo "rg:${env.RESOURCE_GROUP_NAME }"
-            echo "containerapp:${ env.MACAE_CONTAINER_APP }"
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ vars.MACAE_RG  }}/providers/Microsoft.App/containerApps/${{ vars.MACAE_BACKEND_CONTAINER_NAME }}/start?api-version=2025-04-01"
 
       - name: Install dependencies
         run: |
@@ -191,5 +188,5 @@ jobs:
         with:
           azcliversion: "latest"
           inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.RESOURCE_GROUP_NAME }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP  }}/stop?api-version=2025-01-01"
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ vars.MACAE_RG  }}/providers/Microsoft.App/containerApps/${{ vars.MACAE_BACKEND_CONTAINER_NAME  }}/stop?api-version=2025-04-01"
             az logout

From b0ef25a36e893fdf9e6587cc9f81a30892c376fb Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Wed, 9 Jul 2025 09:40:34 +0530
Subject: [PATCH 15/70] update

---
 .github/workflows/deploy.yml | 34 ++++++++++++++++++++++++++++++++--
 1 file changed, 32 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 87404ab6f..de4b04f99 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -24,6 +24,7 @@ jobs:
       WEBAPP_URL: ${{ steps.get_output.outputs.WEBAPP_URL }}
       DEPLOYMENT_SUCCESS: ${{ steps.deployment_status.outputs.SUCCESS }}
       API_APP_URL: ${{ steps.get_output.outputs.API_APP_URL }}
+      CONTAINER_APP: ${{steps.get_backend_url.outputs.CONTAINER_APP}}
     steps:
       - name: Checkout Code
         uses: actions/checkout@v3
@@ -141,8 +142,7 @@ jobs:
                 gptModelName="gpt-4o" \
                 gptModelVersion="2024-08-06" \
                 imageTag="${IMAGE_TAG}" \
-              --output json \
-              --debug
+              --output json
 
       - name: Extract Web App and API App URLs
         id: get_output # <-- Add this
@@ -163,6 +163,35 @@ jobs:
             fi
           done
 
+      - name: Get Container App Backend URL
+        id: get_backend_url
+        run: |
+          set -e
+          echo "Fetching backend Container App URL from resource group: ${{ env.RESOURCE_GROUP_NAME }}"
+
+          CONTAINER_APP_NAME=$(az containerapp list \
+          --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
+          --query "[0].name" -o tsv)
+
+          if [ -z "$CONTAINER_APP_NAME" ]; then
+          echo "❌ No container app found in resource group."
+          exit 1
+          fi
+
+
+          CONTAINER_APP_URL=$(az containerapp show \
+          --name "$CONTAINER_APP_NAME" \
+          --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
+          --query "properties.configuration.ingress.fqdn" -o tsv)
+
+          if [ -z "$CONTAINER_APP_URL" ]; then
+          echo "❌ Failed to retrieve the backend container app URL."
+          exit 1
+          fi
+
+          echo "✅ Backend Container App URL: https://${CONTAINER_APP_URL}"
+          echo "BACKEND_API_URL=https://${CONTAINER_APP_URL}" >> $GITHUB_ENV
+
       - name: Extract AI Services and Key Vault Names
         if: always()
         run: |
@@ -202,6 +231,7 @@ jobs:
     with:
       MACAE_WEB_URL: ${{ needs.deploy.outputs.WEBAPP_URL }}
       MACAE_URL_API: ${{ needs.deploy.outputs.API_APP_URL }}
+      MACAE_CONTAINER_APP: ${{needs.deploy.outputs.CONTAINER_APP}}
 
     secrets: inherit
   cleanup-deployment:

From 478f69068f60a3f3b67a5e643e5a06bd2e232d0a Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Wed, 9 Jul 2025 09:50:39 +0530
Subject: [PATCH 16/70] update

---
 .github/workflows/test-automation.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index 2f0ff4a2d..d6264209c 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -22,6 +22,9 @@ on:
         required: false
         type: string
         description: "API URL for MACAE (overrides environment variable)"
+      MACAE_CONTAINER_APP:
+        required: false
+        type: string
     secrets:
       EMAILNOTIFICATION_LOGICAPP_URL_TA:
         required: false

From 6313547114934b4d75d53ea6bdc692dfc9f8f9ca Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Wed, 9 Jul 2025 10:17:22 +0530
Subject: [PATCH 17/70] update

---
 .github/workflows/test-automation.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index d6264209c..d3da9eb30 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -59,7 +59,7 @@ jobs:
         with:
           azcliversion: "latest"
           inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ vars.MACAE_RG  }}/providers/Microsoft.App/containerApps/${{ vars.MACAE_BACKEND_CONTAINER_NAME }}/start?api-version=2025-04-01"
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ vars.MACAE_RG  }}/providers/Microsoft.App/containerApps/${{ vars.MACAE_BACKEND_CONTAINER_NAME }}/start?api-version=2025-01-01"
 
       - name: Install dependencies
         run: |
@@ -191,5 +191,5 @@ jobs:
         with:
           azcliversion: "latest"
           inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ vars.MACAE_RG  }}/providers/Microsoft.App/containerApps/${{ vars.MACAE_BACKEND_CONTAINER_NAME  }}/stop?api-version=2025-04-01"
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ vars.MACAE_RG  }}/providers/Microsoft.App/containerApps/${{ vars.MACAE_BACKEND_CONTAINER_NAME  }}/stop?api-version=2025-01-01"
             az logout

From fafb7bf16c526d5ea00455137a7e78410a1f4aef Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Wed, 9 Jul 2025 10:49:01 +0530
Subject: [PATCH 18/70] update

---
 .github/workflows/deploy.yml          | 1 +
 .github/workflows/test-automation.yml | 6 ++++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index de4b04f99..8f91bb067 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -231,6 +231,7 @@ jobs:
     with:
       MACAE_WEB_URL: ${{ needs.deploy.outputs.WEBAPP_URL }}
       MACAE_URL_API: ${{ needs.deploy.outputs.API_APP_URL }}
+      MACAE_RG: ${{needs.deploy.outputs.RESOURCE_GROUP_NAME}}
       MACAE_CONTAINER_APP: ${{needs.deploy.outputs.CONTAINER_APP}}
 
     secrets: inherit
diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index d3da9eb30..600b2b117 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -34,6 +34,8 @@ env:
   # Use input URL if provided (from deploy pipeline), otherwise fall back to vars
   url: ${{ inputs.MACAE_WEB_URL  }}
   api_url: ${{ inputs.MACAE_URL_API}}
+  MACAE_RG: ${{inputs.MACAE_RG}}
+  MACAE_CONTAINER_APP: ${{inputs.MACAE_CONTAINER_APP}}
   accelerator_name: "MACAE"
 
 jobs:
@@ -59,7 +61,7 @@ jobs:
         with:
           azcliversion: "latest"
           inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ vars.MACAE_RG  }}/providers/Microsoft.App/containerApps/${{ vars.MACAE_BACKEND_CONTAINER_NAME }}/start?api-version=2025-01-01"
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG  }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/start?api-version=2025-01-01"
 
       - name: Install dependencies
         run: |
@@ -191,5 +193,5 @@ jobs:
         with:
           azcliversion: "latest"
           inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ vars.MACAE_RG  }}/providers/Microsoft.App/containerApps/${{ vars.MACAE_BACKEND_CONTAINER_NAME  }}/stop?api-version=2025-01-01"
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG  }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP  }}/stop?api-version=2025-01-01"
             az logout

From 4ed85f17e8ef1668f37e86f42e4a4135059e566b Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Wed, 9 Jul 2025 10:54:21 +0530
Subject: [PATCH 19/70] edit

---
 .github/workflows/test-automation.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index 600b2b117..1768fd23b 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -22,6 +22,9 @@ on:
         required: false
         type: string
         description: "API URL for MACAE (overrides environment variable)"
+      MACAE_RG:
+        required: true
+        type: string
       MACAE_CONTAINER_APP:
         required: false
         type: string

From 9629d00f5cf812c0c9045db1ac4b68e16503c42e Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Wed, 9 Jul 2025 13:48:54 +0530
Subject: [PATCH 20/70] edit

---
 .github/workflows/deploy.yml          | 4 ++--
 .github/workflows/test-automation.yml | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 8f91bb067..95b8a6747 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -24,7 +24,7 @@ jobs:
       WEBAPP_URL: ${{ steps.get_output.outputs.WEBAPP_URL }}
       DEPLOYMENT_SUCCESS: ${{ steps.deployment_status.outputs.SUCCESS }}
       API_APP_URL: ${{ steps.get_output.outputs.API_APP_URL }}
-      CONTAINER_APP: ${{steps.get_backend_url.outputs.CONTAINER_APP}}
+      CONTAINER_APP: ${{steps.get_backend_url.outputs.CONTAINER_APP_URL}}
     steps:
       - name: Checkout Code
         uses: actions/checkout@v3
@@ -232,7 +232,7 @@ jobs:
       MACAE_WEB_URL: ${{ needs.deploy.outputs.WEBAPP_URL }}
       MACAE_URL_API: ${{ needs.deploy.outputs.API_APP_URL }}
       MACAE_RG: ${{needs.deploy.outputs.RESOURCE_GROUP_NAME}}
-      MACAE_CONTAINER_APP: ${{needs.deploy.outputs.CONTAINER_APP}}
+      MACAE_CONTAINER_APP: ${{needs.deploy.outputs.CONTAINER_APP_URL}}
 
     secrets: inherit
   cleanup-deployment:
diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index 1768fd23b..76d51fc62 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -23,7 +23,7 @@ on:
         type: string
         description: "API URL for MACAE (overrides environment variable)"
       MACAE_RG:
-        required: true
+        required: false
         type: string
       MACAE_CONTAINER_APP:
         required: false
@@ -64,7 +64,7 @@ jobs:
         with:
           azcliversion: "latest"
           inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG  }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/start?api-version=2025-01-01"
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG  }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/start?api-version=2025-04-01"
 
       - name: Install dependencies
         run: |
@@ -196,5 +196,5 @@ jobs:
         with:
           azcliversion: "latest"
           inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG  }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP  }}/stop?api-version=2025-01-01"
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG  }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP  }}/stop?api-version=2025-04-01"
             az logout

From b5ad2938d555f0dc7d38b79c721c78fa5978666e Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Wed, 9 Jul 2025 14:42:09 +0530
Subject: [PATCH 21/70] update

---
 .github/workflows/deploy.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 95b8a6747..467310efe 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -23,7 +23,7 @@ jobs:
       RESOURCE_GROUP_NAME: ${{ steps.check_create_rg.outputs.RESOURCE_GROUP_NAME }}
       WEBAPP_URL: ${{ steps.get_output.outputs.WEBAPP_URL }}
       DEPLOYMENT_SUCCESS: ${{ steps.deployment_status.outputs.SUCCESS }}
-      API_APP_URL: ${{ steps.get_output.outputs.API_APP_URL }}
+      API_APP_URL: ${{ steps.get_output.outputs.CONTAINER_APP_URL }}
       CONTAINER_APP: ${{steps.get_backend_url.outputs.CONTAINER_APP_URL}}
     steps:
       - name: Checkout Code
@@ -91,7 +91,7 @@ jobs:
           ACCL_NAME="macae"  # Account name as specified
           SHORT_UUID=$(uuidgen | cut -d'-' -f1)
           UNIQUE_RG_NAME="arg-${ACCL_NAME}-${SHORT_UUID}"
-          echo "RESOURCE_GROUP_NAME=${UNIQUE_RG_NAME}" >> $GITHUB_ENV
+          echo "RESOURCE_GROUP_NAME=${UNIQUE_RG_NAME}" >> $GITHUB_OUTPUT
           echo "Generated Resource_GROUP_PREFIX: ${UNIQUE_RG_NAME}"
 
       - name: Check and Create Resource Group
@@ -190,7 +190,7 @@ jobs:
           fi
 
           echo "✅ Backend Container App URL: https://${CONTAINER_APP_URL}"
-          echo "BACKEND_API_URL=https://${CONTAINER_APP_URL}" >> $GITHUB_ENV
+          echo "CONTAINER_APP_URL=https://${CONTAINER_APP_URL}" >> $GITHUB_OUTPUT
 
       - name: Extract AI Services and Key Vault Names
         if: always()
@@ -230,7 +230,7 @@ jobs:
     uses: ./.github/workflows/test-automation.yml
     with:
       MACAE_WEB_URL: ${{ needs.deploy.outputs.WEBAPP_URL }}
-      MACAE_URL_API: ${{ needs.deploy.outputs.API_APP_URL }}
+      MACAE_URL_API: ${{ needs.deploy.outputs.CONTAINER_APP_URL }}
       MACAE_RG: ${{needs.deploy.outputs.RESOURCE_GROUP_NAME}}
       MACAE_CONTAINER_APP: ${{needs.deploy.outputs.CONTAINER_APP_URL}}
 

From 12d46db5d02e431f19093b9fc393ddcd37bb79f8 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Wed, 9 Jul 2025 14:53:46 +0530
Subject: [PATCH 22/70] edit

---
 .github/workflows/deploy.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 467310efe..a19cb8aca 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -91,7 +91,7 @@ jobs:
           ACCL_NAME="macae"  # Account name as specified
           SHORT_UUID=$(uuidgen | cut -d'-' -f1)
           UNIQUE_RG_NAME="arg-${ACCL_NAME}-${SHORT_UUID}"
-          echo "RESOURCE_GROUP_NAME=${UNIQUE_RG_NAME}" >> $GITHUB_OUTPUT
+          echo "RESOURCE_GROUP_NAME=${UNIQUE_RG_NAME}" >> $GITHUB_ENV
           echo "Generated Resource_GROUP_PREFIX: ${UNIQUE_RG_NAME}"
 
       - name: Check and Create Resource Group

From e99a1cd66e0e4ec522cf46143e0545ab1cbe6683 Mon Sep 17 00:00:00 2001
From: Kanchan-Microsoft <v-knagshetti@microsoft.com>
Date: Wed, 9 Jul 2025 15:45:56 +0530
Subject: [PATCH 23/70] Update deploy.yml

---
 .github/workflows/deploy.yml | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index a19cb8aca..538ee6f4e 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -24,7 +24,7 @@ jobs:
       WEBAPP_URL: ${{ steps.get_output.outputs.WEBAPP_URL }}
       DEPLOYMENT_SUCCESS: ${{ steps.deployment_status.outputs.SUCCESS }}
       API_APP_URL: ${{ steps.get_output.outputs.CONTAINER_APP_URL }}
-      CONTAINER_APP: ${{steps.get_backend_url.outputs.CONTAINER_APP_URL}}
+      CONTAINER_APP: ${{steps.get_backend_url.outputs.CONTAINER_APP}}
     steps:
       - name: Checkout Code
         uses: actions/checkout@v3
@@ -156,10 +156,6 @@ jobs:
               WEBAPP_URL="https://${NAME}.azurewebsites.net"
               echo "WEBAPP_URL=$WEBAPP_URL" >> $GITHUB_OUTPUT
               echo "WEBAPP_URL=$WEBAPP_URL" 
-            elif [[ $NAME == api-* ]]; then
-              API_APP_URL="https://${NAME}.azurewebsites.net"
-              echo "API_APP_URL=$API_APP_URL" >> $GITHUB_OUTPUT
-              echo "API_APP_URL=$API_APP_URL"
             fi
           done
 
@@ -191,6 +187,7 @@ jobs:
 
           echo "✅ Backend Container App URL: https://${CONTAINER_APP_URL}"
           echo "CONTAINER_APP_URL=https://${CONTAINER_APP_URL}" >> $GITHUB_OUTPUT
+          echo "CONTAINER_APP_NAME=${CONTAINER_APP_NAME}" >> $GITHUB_OUTPUT
 
       - name: Extract AI Services and Key Vault Names
         if: always()
@@ -232,7 +229,7 @@ jobs:
       MACAE_WEB_URL: ${{ needs.deploy.outputs.WEBAPP_URL }}
       MACAE_URL_API: ${{ needs.deploy.outputs.CONTAINER_APP_URL }}
       MACAE_RG: ${{needs.deploy.outputs.RESOURCE_GROUP_NAME}}
-      MACAE_CONTAINER_APP: ${{needs.deploy.outputs.CONTAINER_APP_URL}}
+      MACAE_CONTAINER_APP: ${{needs.deploy.outputs.CONTAINER_APP}}
 
     secrets: inherit
   cleanup-deployment:

From 03c56cf2c895ddd2b5c1275fa897ba7066ee9689 Mon Sep 17 00:00:00 2001
From: Harmanpreet-Microsoft <v-harmanprka@microsoft.com>
Date: Wed, 9 Jul 2025 16:22:33 +0530
Subject: [PATCH 24/70] Update test-automation.yml

---
 .github/workflows/test-automation.yml | 79 ++++++++++++++-------------
 1 file changed, 40 insertions(+), 39 deletions(-)

diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index 76d51fc62..906aa1748 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -9,9 +9,8 @@ on:
     paths:
       - "tests/e2e-test/**"
   schedule:
-    - cron: "0 13 * * *" # Runs at 1 PM UTC
+    - cron: "0 13 * * *"
   workflow_dispatch:
-
   workflow_call:
     inputs:
       MACAE_WEB_URL:
@@ -33,17 +32,16 @@ on:
         required: false
         description: "Logic App URL for email notifications"
 
-env:
-  # Use input URL if provided (from deploy pipeline), otherwise fall back to vars
-  url: ${{ inputs.MACAE_WEB_URL  }}
-  api_url: ${{ inputs.MACAE_URL_API}}
-  MACAE_RG: ${{inputs.MACAE_RG}}
-  MACAE_CONTAINER_APP: ${{inputs.MACAE_CONTAINER_APP}}
-  accelerator_name: "MACAE"
-
 jobs:
   test:
     runs-on: ubuntu-latest
+    env:
+      MACAE_WEB_URL: ${{ inputs.MACAE_WEB_URL }}
+      MACAE_URL_API: ${{ inputs.MACAE_URL_API }}
+      MACAE_RG: ${{ inputs.MACAE_RG }}
+      MACAE_CONTAINER_APP: ${{ inputs.MACAE_CONTAINER_APP }}
+      accelerator_name: "MACAE"
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -59,12 +57,11 @@ jobs:
           creds: '{"clientId":"${{ secrets.AZURE_CLIENT_ID }}","clientSecret":"${{ secrets.AZURE_CLIENT_SECRET }}","subscriptionId":"${{ secrets.AZURE_SUBSCRIPTION_ID }}","tenantId":"${{ secrets.AZURE_TENANT_ID }}"}'
 
       - name: Start Container App
-        id: start-container-app
         uses: azure/cli@v2
         with:
           azcliversion: "latest"
           inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG  }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/start?api-version=2025-04-01"
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/start?api-version=2025-04-01"
 
       - name: Install dependencies
         run: |
@@ -74,41 +71,46 @@ jobs:
       - name: Ensure browsers are installed
         run: python -m playwright install --with-deps chromium
 
-      - name: Validate URL
+      - name: Validate Inputs
         run: |
-          if [ -z "${{ env.url }}" ]; then
-            echo "ERROR: No URL provided for testing"
+          if [ -z "${{ env.MACAE_WEB_URL }}" ]; then
+            echo "ERROR: No Web URL provided for testing"
             exit 1
-          elif [ -z "${{ env.api_url }}" ]; then
+          elif [ -z "${{ env.MACAE_URL_API }}" ]; then
             echo "ERROR: No API URL provided for testing"
             exit 1
+          elif [ -z "${{ env.MACAE_RG }}" ]; then
+            echo "ERROR: Resource group name missing"
+            exit 1
+          elif [ -z "${{ env.MACAE_CONTAINER_APP }}" ]; then
+            echo "ERROR: Container app name missing"
+            exit 1
           fi
-          echo "Testing URL: ${{ env.url }}"
-          echo "Testing API URL: ${{ env.api_url }}"
+
       - name: Wait for Application to be Ready
         run: |
-          echo "Waiting for application to be ready at ${{ env.url }} "
+          echo "Waiting for application to be ready at ${{ env.MACAE_WEB_URL }}"
           max_attempts=10
           attempt=1
 
           while [ $attempt -le $max_attempts ]; do
             echo "Attempt $attempt: Checking if application is ready..."
-            if curl -f -s "${{ env.url }}" > /dev/null; then
+            if curl -f -s "${{ env.MACAE_WEB_URL }}" > /dev/null; then
               echo "Application is ready!"
               break
             fi
-            
+
             if [ $attempt -eq $max_attempts ]; then
               echo "Application is not ready after $max_attempts attempts"
               exit 1
             fi
-            
+
             echo "Application not ready, waiting 30 seconds..."
             sleep 30
             attempt=$((attempt + 1))
           done
 
-      - name: Run tests(1)
+      - name: Run tests (1)
         id: test1
         run: |
           xvfb-run pytest --headed --html=report/report.html --self-contained-html
@@ -116,26 +118,26 @@ jobs:
         continue-on-error: true
 
       - name: Sleep for 30 seconds
-        if: ${{ steps.test1.outcome == 'failure' }}
+        if: steps.test1.outcome == 'failure'
         run: sleep 30s
         shell: bash
 
-      - name: Run tests(2)
+      - name: Run tests (2)
         id: test2
-        if: ${{ steps.test1.outcome == 'failure' }}
+        if: steps.test1.outcome == 'failure'
         run: |
           xvfb-run pytest --headed --html=report/report.html --self-contained-html
         working-directory: tests/e2e-test
         continue-on-error: true
 
       - name: Sleep for 60 seconds
-        if: ${{ steps.test2.outcome == 'failure' }}
+        if: steps.test2.outcome == 'failure'
         run: sleep 60s
         shell: bash
 
-      - name: Run tests(3)
+      - name: Run tests (3)
         id: test3
-        if: ${{ steps.test2.outcome == 'failure' }}
+        if: steps.test2.outcome == 'failure'
         run: |
           xvfb-run pytest --headed --html=report/report.html --self-contained-html
         working-directory: tests/e2e-test
@@ -147,15 +149,15 @@ jobs:
         with:
           name: test-report-${{ github.run_id }}
           path: tests/e2e-test/report/*
+
       - name: Determine Test Result
         id: test_result
         run: |
-          IS_SUCCESS=${{ steps.test1.outcome == 'success' || steps.test2.outcome == 'success' || steps.test3.outcome == 'success' }}
-          echo "IS_SUCCESS=$IS_SUCCESS" >> $GITHUB_OUTPUT
-
-          if [ "$IS_SUCCESS" = "true" ]; then
+          if [[ "${{ steps.test1.outcome }}" == "success" || "${{ steps.test2.outcome }}" == "success" || "${{ steps.test3.outcome }}" == "success" ]]; then
+            echo "IS_SUCCESS=true" >> $GITHUB_OUTPUT
             echo "✅ Tests passed!"
           else
+            echo "IS_SUCCESS=false" >> $GITHUB_OUTPUT
             echo "❌ All test attempts failed"
             exit 1
           fi
@@ -166,26 +168,25 @@ jobs:
           RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
           REPORT_URL=${{ steps.upload_report.outputs.artifact-url }}
           IS_SUCCESS=${{ steps.test_result.outputs.IS_SUCCESS }}
-          # Construct the email body
+
           if [ "$IS_SUCCESS" = "true" ]; then
             EMAIL_BODY=$(cat <<EOF
             {
               "body": "<p>Dear Team,</p><p>We would like to inform you that the ${{ env.accelerator_name }} Test Automation process has completed successfully.</p><p><strong>Run URL:</strong> <a href=\"${RUN_URL}\">${RUN_URL}</a><br></p><p><strong>Test Report:</strong> <a href=\"${REPORT_URL}\">${REPORT_URL}</a></p><p>Best regards,<br>Your Automation Team</p>",
               "subject": "${{ env.accelerator_name }} Test Automation - Success"
             }
-          EOF
+EOF
             )
           else
             EMAIL_BODY=$(cat <<EOF
             {
-              "body": "<p>Dear Team,</p><p>We would like to inform you that the ${{ env.accelerator_name }} Test Automation process  has encountered an issue and has failed to complete successfully.</p><p><strong>Run URL:</strong> <a href=\"${RUN_URL}\">${RUN_URL}</a><br> ${OUTPUT}</p><p><strong>Test Report:</strong> <a href=\"${REPORT_URL}\">${REPORT_URL}</a></p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>",
+              "body": "<p>Dear Team,</p><p>We would like to inform you that the ${{ env.accelerator_name }} Test Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Run URL:</strong> <a href=\"${RUN_URL}\">${RUN_URL}</a><br></p><p><strong>Test Report:</strong> <a href=\"${REPORT_URL}\">${REPORT_URL}</a></p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>",
               "subject": "${{ env.accelerator_name }} Test Automation - Failure"
             }
-          EOF
+EOF
             )
           fi
 
-          # Send the notification
           curl -X POST "${{ secrets.EMAILNOTIFICATION_LOGICAPP_URL_TA }}" \
             -H "Content-Type: application/json" \
             -d "$EMAIL_BODY" || echo "Failed to send notification"
@@ -196,5 +197,5 @@ jobs:
         with:
           azcliversion: "latest"
           inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG  }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP  }}/stop?api-version=2025-04-01"
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/stop?api-version=2025-04-01"
             az logout

From b8d8cd87741b3c5d59ca068f36ce2905add63012 Mon Sep 17 00:00:00 2001
From: Harmanpreet-Microsoft <v-harmanprka@microsoft.com>
Date: Wed, 9 Jul 2025 16:24:15 +0530
Subject: [PATCH 25/70] Update deploy.yml

---
 .github/workflows/deploy.yml | 119 +++++++++++------------------------
 1 file changed, 35 insertions(+), 84 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 538ee6f4e..75f55ca5f 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -84,45 +84,38 @@ jobs:
       - name: Install Bicep CLI
         run: az bicep install
 
+
       - name: Generate Resource Group Name
         id: generate_rg_name
         run: |
-          echo "Generating a unique resource group name..."
-          ACCL_NAME="macae"  # Account name as specified
+          ACCL_NAME="macae"
           SHORT_UUID=$(uuidgen | cut -d'-' -f1)
           UNIQUE_RG_NAME="arg-${ACCL_NAME}-${SHORT_UUID}"
           echo "RESOURCE_GROUP_NAME=${UNIQUE_RG_NAME}" >> $GITHUB_ENV
           echo "Generated Resource_GROUP_PREFIX: ${UNIQUE_RG_NAME}"
-
+ 
       - name: Check and Create Resource Group
         id: check_create_rg
         run: |
-          set -e  
-          echo "Checking if resource group exists..."
+          set -e
           rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
           if [ "$rg_exists" = "false" ]; then
-            echo "Resource group does not exist. Creating..."
-            az group create --name ${{ env.RESOURCE_GROUP_NAME }} --location ${{ env.AZURE_LOCATION }} || { echo "Error creating resource group"; exit 1; }
-          else
-            echo "Resource group already exists."
+            az group create --name ${{ env.RESOURCE_GROUP_NAME }} --location ${{ env.AZURE_LOCATION }}
           fi
-
+          echo "RESOURCE_GROUP_NAME=${{ env.RESOURCE_GROUP_NAME }}" >> $GITHUB_OUTPUT
+ 
       - name: Generate Unique Solution Prefix
         id: generate_solution_prefix
         run: |
-          set -e
           COMMON_PART="macae"
-          TIMESTAMP=$(date +%s)  
-          UPDATED_TIMESTAMP=$(echo $TIMESTAMP | tail -c 6) 
+          TIMESTAMP=$(date +%s)
+          UPDATED_TIMESTAMP=$(echo $TIMESTAMP | tail -c 6)
           UNIQUE_SOLUTION_PREFIX="${COMMON_PART}${UPDATED_TIMESTAMP}"
           echo "SOLUTION_PREFIX=${UNIQUE_SOLUTION_PREFIX}" >> $GITHUB_ENV
-          echo "Generated SOLUTION_PREFIX: ${UNIQUE_SOLUTION_PREFIX}"
-
+ 
       - name: Deploy Bicep Template
         id: deploy
         run: |
-          set -e
-          # set image tag based on branch
           if [[ "${{ env.BRANCH_NAME }}" == "main" ]]; then
             IMAGE_TAG="latest"
           elif [[ "${{ env.BRANCH_NAME }}" == "hotfix" ]]; then
@@ -130,81 +123,46 @@ jobs:
           else
             IMAGE_TAG="latest"
           fi
-
+ 
           az deployment group create \
             --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
             --template-file infra/main.bicep \
             --parameters \
-                solutionPrefix=${{env.SOLUTION_PREFIX}} \
-                solutionLocation="${{env.AZURE_LOCATION}}" \
-                azureOpenAILocation="${{env.AZURE_LOCATION}}" \
-                modelDeploymentType="GlobalStandard" \
-                gptModelName="gpt-4o" \
-                gptModelVersion="2024-08-06" \
-                imageTag="${IMAGE_TAG}" \
-              --output json
-
+              solutionPrefix=${{ env.SOLUTION_PREFIX }} \
+              solutionLocation="${{ env.AZURE_LOCATION }}" \
+              azureOpenAILocation="${{ env.AZURE_LOCATION }}" \
+              modelDeploymentType="GlobalStandard" \
+              gptModelName="gpt-4o" \
+              gptModelVersion="2024-08-06" \
+              imageTag="${IMAGE_TAG}" \
+            --output json
+ 
       - name: Extract Web App and API App URLs
-        id: get_output # <-- Add this
+        id: get_output
         run: |
-          echo "Fetching Web Apps..."
-
           WEBAPP_NAMES=$(az webapp list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --query "[].name" -o tsv)
-          echo "Detected Web Apps: $WEBAPP_NAMES"
           for NAME in $WEBAPP_NAMES; do
             if [[ $NAME == app-* ]]; then
               WEBAPP_URL="https://${NAME}.azurewebsites.net"
               echo "WEBAPP_URL=$WEBAPP_URL" >> $GITHUB_OUTPUT
-              echo "WEBAPP_URL=$WEBAPP_URL" 
             fi
           done
-
+ 
       - name: Get Container App Backend URL
         id: get_backend_url
         run: |
-          set -e
-          echo "Fetching backend Container App URL from resource group: ${{ env.RESOURCE_GROUP_NAME }}"
-
           CONTAINER_APP_NAME=$(az containerapp list \
-          --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
-          --query "[0].name" -o tsv)
-
-          if [ -z "$CONTAINER_APP_NAME" ]; then
-          echo "❌ No container app found in resource group."
-          exit 1
-          fi
-
-
+            --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
+            --query "[0].name" -o tsv)
+ 
           CONTAINER_APP_URL=$(az containerapp show \
-          --name "$CONTAINER_APP_NAME" \
-          --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
-          --query "properties.configuration.ingress.fqdn" -o tsv)
-
-          if [ -z "$CONTAINER_APP_URL" ]; then
-          echo "❌ Failed to retrieve the backend container app URL."
-          exit 1
-          fi
-
-          echo "✅ Backend Container App URL: https://${CONTAINER_APP_URL}"
+            --name "$CONTAINER_APP_NAME" \
+            --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
+            --query "properties.configuration.ingress.fqdn" -o tsv)
+ 
           echo "CONTAINER_APP_URL=https://${CONTAINER_APP_URL}" >> $GITHUB_OUTPUT
-          echo "CONTAINER_APP_NAME=${CONTAINER_APP_NAME}" >> $GITHUB_OUTPUT
-
-      - name: Extract AI Services and Key Vault Names
-        if: always()
-        run: |
-          echo "Fetching AI Services and Key Vault names before deletion..."
-
-          # Get Key Vault name
-          KEYVAULT_NAME=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.KeyVault/vaults" --query "[].name" -o tsv)
-          echo "Detected Key Vault: $KEYVAULT_NAME"
-          echo "KEYVAULT_NAME=$KEYVAULT_NAME" >> $GITHUB_ENV
-
-          # Get AI Services names and convert them into a space-separated string
-          AI_SERVICES=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.CognitiveServices/accounts" --query "[].name" -o tsv | tr '\n' ' ')
-
-          echo "Detected AI Services: $AI_SERVICES"
-          echo "AI_SERVICES=$AI_SERVICES" >> $GITHUB_ENV
-
+          echo "CONTAINER_APP=${CONTAINER_APP_NAME}" >> $GITHUB_OUTPUT
+ 
       - name: Set Deployment Status
         id: deployment_status
         if: always()
@@ -214,23 +172,16 @@ jobs:
           else
             echo "SUCCESS=false" >> $GITHUB_OUTPUT
           fi
-      - name: Logout from Azure
-        if: always()
-        run: |
-          az logout
-          echo "Logged out from Azure."
-
-  # NEW: E2E Test Job that calls the reusable workflow
+ 
   e2e-test:
     needs: deploy
     if: needs.deploy.outputs.DEPLOYMENT_SUCCESS == 'true'
     uses: ./.github/workflows/test-automation.yml
     with:
       MACAE_WEB_URL: ${{ needs.deploy.outputs.WEBAPP_URL }}
-      MACAE_URL_API: ${{ needs.deploy.outputs.CONTAINER_APP_URL }}
-      MACAE_RG: ${{needs.deploy.outputs.RESOURCE_GROUP_NAME}}
-      MACAE_CONTAINER_APP: ${{needs.deploy.outputs.CONTAINER_APP}}
-
+      MACAE_URL_API: ${{ needs.deploy.outputs.API_APP_URL }}
+      MACAE_RG: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
+      MACAE_CONTAINER_APP: ${{ needs.deploy.outputs.CONTAINER_APP }}
     secrets: inherit
   cleanup-deployment:
     if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''

From a37ea77437b4bfa1a4840db1bc5226af16254713 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Wed, 9 Jul 2025 16:34:08 +0530
Subject: [PATCH 26/70] updated deploy.yml

---
 .github/workflows/deploy.yml          | 76 +++++++++------------------
 .github/workflows/test-automation.yml | 75 +++++++++++++-------------
 2 files changed, 62 insertions(+), 89 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 538ee6f4e..393766a3c 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -87,8 +87,7 @@ jobs:
       - name: Generate Resource Group Name
         id: generate_rg_name
         run: |
-          echo "Generating a unique resource group name..."
-          ACCL_NAME="macae"  # Account name as specified
+          ACCL_NAME="macae"
           SHORT_UUID=$(uuidgen | cut -d'-' -f1)
           UNIQUE_RG_NAME="arg-${ACCL_NAME}-${SHORT_UUID}"
           echo "RESOURCE_GROUP_NAME=${UNIQUE_RG_NAME}" >> $GITHUB_ENV
@@ -97,32 +96,25 @@ jobs:
       - name: Check and Create Resource Group
         id: check_create_rg
         run: |
-          set -e  
-          echo "Checking if resource group exists..."
+          set -e
           rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
           if [ "$rg_exists" = "false" ]; then
-            echo "Resource group does not exist. Creating..."
-            az group create --name ${{ env.RESOURCE_GROUP_NAME }} --location ${{ env.AZURE_LOCATION }} || { echo "Error creating resource group"; exit 1; }
-          else
-            echo "Resource group already exists."
+            az group create --name ${{ env.RESOURCE_GROUP_NAME }} --location ${{ env.AZURE_LOCATION }}
           fi
+          echo "RESOURCE_GROUP_NAME=${{ env.RESOURCE_GROUP_NAME }}" >> $GITHUB_OUTPUT
 
       - name: Generate Unique Solution Prefix
         id: generate_solution_prefix
         run: |
-          set -e
           COMMON_PART="macae"
-          TIMESTAMP=$(date +%s)  
-          UPDATED_TIMESTAMP=$(echo $TIMESTAMP | tail -c 6) 
+          TIMESTAMP=$(date +%s)
+          UPDATED_TIMESTAMP=$(echo $TIMESTAMP | tail -c 6)
           UNIQUE_SOLUTION_PREFIX="${COMMON_PART}${UPDATED_TIMESTAMP}"
           echo "SOLUTION_PREFIX=${UNIQUE_SOLUTION_PREFIX}" >> $GITHUB_ENV
-          echo "Generated SOLUTION_PREFIX: ${UNIQUE_SOLUTION_PREFIX}"
 
       - name: Deploy Bicep Template
         id: deploy
         run: |
-          set -e
-          # set image tag based on branch
           if [[ "${{ env.BRANCH_NAME }}" == "main" ]]; then
             IMAGE_TAG="latest"
           elif [[ "${{ env.BRANCH_NAME }}" == "hotfix" ]]; then
@@ -135,59 +127,40 @@ jobs:
             --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
             --template-file infra/main.bicep \
             --parameters \
-                solutionPrefix=${{env.SOLUTION_PREFIX}} \
-                solutionLocation="${{env.AZURE_LOCATION}}" \
-                azureOpenAILocation="${{env.AZURE_LOCATION}}" \
-                modelDeploymentType="GlobalStandard" \
-                gptModelName="gpt-4o" \
-                gptModelVersion="2024-08-06" \
-                imageTag="${IMAGE_TAG}" \
-              --output json
+              solutionPrefix=${{ env.SOLUTION_PREFIX }} \
+              solutionLocation="${{ env.AZURE_LOCATION }}" \
+              azureOpenAILocation="${{ env.AZURE_LOCATION }}" \
+              modelDeploymentType="GlobalStandard" \
+              gptModelName="gpt-4o" \
+              gptModelVersion="2024-08-06" \
+              imageTag="${IMAGE_TAG}" \
+            --output json
 
       - name: Extract Web App and API App URLs
-        id: get_output # <-- Add this
+        id: get_output
         run: |
-          echo "Fetching Web Apps..."
-
           WEBAPP_NAMES=$(az webapp list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --query "[].name" -o tsv)
-          echo "Detected Web Apps: $WEBAPP_NAMES"
           for NAME in $WEBAPP_NAMES; do
             if [[ $NAME == app-* ]]; then
               WEBAPP_URL="https://${NAME}.azurewebsites.net"
               echo "WEBAPP_URL=$WEBAPP_URL" >> $GITHUB_OUTPUT
-              echo "WEBAPP_URL=$WEBAPP_URL" 
             fi
           done
 
       - name: Get Container App Backend URL
         id: get_backend_url
         run: |
-          set -e
-          echo "Fetching backend Container App URL from resource group: ${{ env.RESOURCE_GROUP_NAME }}"
-
           CONTAINER_APP_NAME=$(az containerapp list \
-          --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
-          --query "[0].name" -o tsv)
-
-          if [ -z "$CONTAINER_APP_NAME" ]; then
-          echo "❌ No container app found in resource group."
-          exit 1
-          fi
-
+            --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
+            --query "[0].name" -o tsv)
 
           CONTAINER_APP_URL=$(az containerapp show \
-          --name "$CONTAINER_APP_NAME" \
-          --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
-          --query "properties.configuration.ingress.fqdn" -o tsv)
-
-          if [ -z "$CONTAINER_APP_URL" ]; then
-          echo "❌ Failed to retrieve the backend container app URL."
-          exit 1
-          fi
+            --name "$CONTAINER_APP_NAME" \
+            --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
+            --query "properties.configuration.ingress.fqdn" -o tsv)
 
-          echo "✅ Backend Container App URL: https://${CONTAINER_APP_URL}"
           echo "CONTAINER_APP_URL=https://${CONTAINER_APP_URL}" >> $GITHUB_OUTPUT
-          echo "CONTAINER_APP_NAME=${CONTAINER_APP_NAME}" >> $GITHUB_OUTPUT
+          echo "CONTAINER_APP=${CONTAINER_APP_NAME}" >> $GITHUB_OUTPUT
 
       - name: Extract AI Services and Key Vault Names
         if: always()
@@ -227,10 +200,9 @@ jobs:
     uses: ./.github/workflows/test-automation.yml
     with:
       MACAE_WEB_URL: ${{ needs.deploy.outputs.WEBAPP_URL }}
-      MACAE_URL_API: ${{ needs.deploy.outputs.CONTAINER_APP_URL }}
-      MACAE_RG: ${{needs.deploy.outputs.RESOURCE_GROUP_NAME}}
-      MACAE_CONTAINER_APP: ${{needs.deploy.outputs.CONTAINER_APP}}
-
+      MACAE_URL_API: ${{ needs.deploy.outputs.API_APP_URL }}
+      MACAE_RG: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
+      MACAE_CONTAINER_APP: ${{ needs.deploy.outputs.CONTAINER_APP }}
     secrets: inherit
   cleanup-deployment:
     if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index 76d51fc62..66bb7bdc0 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -9,9 +9,8 @@ on:
     paths:
       - "tests/e2e-test/**"
   schedule:
-    - cron: "0 13 * * *" # Runs at 1 PM UTC
+    - cron: "0 13 * * *"
   workflow_dispatch:
-
   workflow_call:
     inputs:
       MACAE_WEB_URL:
@@ -33,17 +32,16 @@ on:
         required: false
         description: "Logic App URL for email notifications"
 
-env:
-  # Use input URL if provided (from deploy pipeline), otherwise fall back to vars
-  url: ${{ inputs.MACAE_WEB_URL  }}
-  api_url: ${{ inputs.MACAE_URL_API}}
-  MACAE_RG: ${{inputs.MACAE_RG}}
-  MACAE_CONTAINER_APP: ${{inputs.MACAE_CONTAINER_APP}}
-  accelerator_name: "MACAE"
-
 jobs:
   test:
     runs-on: ubuntu-latest
+    env:
+      MACAE_WEB_URL: ${{ inputs.MACAE_WEB_URL }}
+      MACAE_URL_API: ${{ inputs.MACAE_URL_API }}
+      MACAE_RG: ${{ inputs.MACAE_RG }}
+      MACAE_CONTAINER_APP: ${{ inputs.MACAE_CONTAINER_APP }}
+      accelerator_name: "MACAE"
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -59,12 +57,11 @@ jobs:
           creds: '{"clientId":"${{ secrets.AZURE_CLIENT_ID }}","clientSecret":"${{ secrets.AZURE_CLIENT_SECRET }}","subscriptionId":"${{ secrets.AZURE_SUBSCRIPTION_ID }}","tenantId":"${{ secrets.AZURE_TENANT_ID }}"}'
 
       - name: Start Container App
-        id: start-container-app
         uses: azure/cli@v2
         with:
           azcliversion: "latest"
           inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG  }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/start?api-version=2025-04-01"
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/start?api-version=2025-04-01"
 
       - name: Install dependencies
         run: |
@@ -74,41 +71,46 @@ jobs:
       - name: Ensure browsers are installed
         run: python -m playwright install --with-deps chromium
 
-      - name: Validate URL
+      - name: Validate Inputs
         run: |
-          if [ -z "${{ env.url }}" ]; then
-            echo "ERROR: No URL provided for testing"
+          if [ -z "${{ env.MACAE_WEB_URL }}" ]; then
+            echo "ERROR: No Web URL provided for testing"
             exit 1
-          elif [ -z "${{ env.api_url }}" ]; then
+          elif [ -z "${{ env.MACAE_URL_API }}" ]; then
             echo "ERROR: No API URL provided for testing"
             exit 1
+          elif [ -z "${{ env.MACAE_RG }}" ]; then
+            echo "ERROR: Resource group name missing"
+            exit 1
+          elif [ -z "${{ env.MACAE_CONTAINER_APP }}" ]; then
+            echo "ERROR: Container app name missing"
+            exit 1
           fi
-          echo "Testing URL: ${{ env.url }}"
-          echo "Testing API URL: ${{ env.api_url }}"
+
       - name: Wait for Application to be Ready
         run: |
-          echo "Waiting for application to be ready at ${{ env.url }} "
+          echo "Waiting for application to be ready at ${{ env.MACAE_WEB_URL }}"
           max_attempts=10
           attempt=1
 
           while [ $attempt -le $max_attempts ]; do
             echo "Attempt $attempt: Checking if application is ready..."
-            if curl -f -s "${{ env.url }}" > /dev/null; then
+            if curl -f -s "${{ env.MACAE_WEB_URL }}" > /dev/null; then
               echo "Application is ready!"
               break
             fi
-            
+
             if [ $attempt -eq $max_attempts ]; then
               echo "Application is not ready after $max_attempts attempts"
               exit 1
             fi
-            
+
             echo "Application not ready, waiting 30 seconds..."
             sleep 30
             attempt=$((attempt + 1))
           done
 
-      - name: Run tests(1)
+      - name: Run tests (1)
         id: test1
         run: |
           xvfb-run pytest --headed --html=report/report.html --self-contained-html
@@ -116,26 +118,26 @@ jobs:
         continue-on-error: true
 
       - name: Sleep for 30 seconds
-        if: ${{ steps.test1.outcome == 'failure' }}
+        if: steps.test1.outcome == 'failure'
         run: sleep 30s
         shell: bash
 
-      - name: Run tests(2)
+      - name: Run tests (2)
         id: test2
-        if: ${{ steps.test1.outcome == 'failure' }}
+        if: steps.test1.outcome == 'failure'
         run: |
           xvfb-run pytest --headed --html=report/report.html --self-contained-html
         working-directory: tests/e2e-test
         continue-on-error: true
 
       - name: Sleep for 60 seconds
-        if: ${{ steps.test2.outcome == 'failure' }}
+        if: steps.test2.outcome == 'failure'
         run: sleep 60s
         shell: bash
 
-      - name: Run tests(3)
+      - name: Run tests (3)
         id: test3
-        if: ${{ steps.test2.outcome == 'failure' }}
+        if: steps.test2.outcome == 'failure'
         run: |
           xvfb-run pytest --headed --html=report/report.html --self-contained-html
         working-directory: tests/e2e-test
@@ -147,15 +149,15 @@ jobs:
         with:
           name: test-report-${{ github.run_id }}
           path: tests/e2e-test/report/*
+
       - name: Determine Test Result
         id: test_result
         run: |
-          IS_SUCCESS=${{ steps.test1.outcome == 'success' || steps.test2.outcome == 'success' || steps.test3.outcome == 'success' }}
-          echo "IS_SUCCESS=$IS_SUCCESS" >> $GITHUB_OUTPUT
-
-          if [ "$IS_SUCCESS" = "true" ]; then
+          if [[ "${{ steps.test1.outcome }}" == "success" || "${{ steps.test2.outcome }}" == "success" || "${{ steps.test3.outcome }}" == "success" ]]; then
+            echo "IS_SUCCESS=true" >> $GITHUB_OUTPUT
             echo "✅ Tests passed!"
           else
+            echo "IS_SUCCESS=false" >> $GITHUB_OUTPUT
             echo "❌ All test attempts failed"
             exit 1
           fi
@@ -166,7 +168,7 @@ jobs:
           RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
           REPORT_URL=${{ steps.upload_report.outputs.artifact-url }}
           IS_SUCCESS=${{ steps.test_result.outputs.IS_SUCCESS }}
-          # Construct the email body
+
           if [ "$IS_SUCCESS" = "true" ]; then
             EMAIL_BODY=$(cat <<EOF
             {
@@ -178,14 +180,13 @@ jobs:
           else
             EMAIL_BODY=$(cat <<EOF
             {
-              "body": "<p>Dear Team,</p><p>We would like to inform you that the ${{ env.accelerator_name }} Test Automation process  has encountered an issue and has failed to complete successfully.</p><p><strong>Run URL:</strong> <a href=\"${RUN_URL}\">${RUN_URL}</a><br> ${OUTPUT}</p><p><strong>Test Report:</strong> <a href=\"${REPORT_URL}\">${REPORT_URL}</a></p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>",
+              "body": "<p>Dear Team,</p><p>We would like to inform you that the ${{ env.accelerator_name }} Test Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Run URL:</strong> <a href=\"${RUN_URL}\">${RUN_URL}</a><br></p><p><strong>Test Report:</strong> <a href=\"${REPORT_URL}\">${REPORT_URL}</a></p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>",
               "subject": "${{ env.accelerator_name }} Test Automation - Failure"
             }
           EOF
             )
           fi
 
-          # Send the notification
           curl -X POST "${{ secrets.EMAILNOTIFICATION_LOGICAPP_URL_TA }}" \
             -H "Content-Type: application/json" \
             -d "$EMAIL_BODY" || echo "Failed to send notification"
@@ -196,5 +197,5 @@ jobs:
         with:
           azcliversion: "latest"
           inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG  }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP  }}/stop?api-version=2025-04-01"
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/stop?api-version=2025-04-01"
             az logout

From 39b03b33c839e8341dd991aec3086b57664ec1d9 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Wed, 9 Jul 2025 16:43:13 +0530
Subject: [PATCH 27/70] updated test-automation

---
 .github/workflows/deploy-waf.yml      | 58 ++++++++++++++++++++++-----
 .github/workflows/test-automation.yml |  4 +-
 2 files changed, 49 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/deploy-waf.yml b/.github/workflows/deploy-waf.yml
index 19db281ff..b1fa8dbf8 100644
--- a/.github/workflows/deploy-waf.yml
+++ b/.github/workflows/deploy-waf.yml
@@ -11,7 +11,7 @@ on:
       - hotfix
   schedule:
     - cron: "0 11,23 * * *" # Runs at 11:00 AM and 11:00 PM GMT
-  workflow_dispatch:
+  workflow_dispatch: #Allow manual triggering
 env:
   GPT_MIN_CAPACITY: 140
   BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
@@ -23,7 +23,8 @@ jobs:
       RESOURCE_GROUP_NAME: ${{ steps.check_create_rg.outputs.RESOURCE_GROUP_NAME }}
       WEBAPP_URL: ${{ steps.get_output.outputs.WEBAPP_URL }}
       DEPLOYMENT_SUCCESS: ${{ steps.deployment_status.outputs.SUCCESS }}
-      API_APP_URL: ${{ steps.get_output.outputs.API_APP_URL }}
+      API_APP_URL: ${{ steps.get_output.outputs.CONTAINER_APP_URL }}
+      CONTAINER_APP: ${{steps.get_backend_url.outputs.CONTAINER_APP}}
     steps:
       - name: Checkout Code
         uses: actions/checkout@v3
@@ -129,18 +130,19 @@ jobs:
           else
             IMAGE_TAG="latest"
           fi
+
           az deployment group create \
             --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
             --template-file infra/main.bicep \
-            --parameters infra/main.waf-aligned.bicepparam \
             --parameters \
                 solutionPrefix=${{env.SOLUTION_PREFIX}} \
-                solutionLocation="swedencentral" \
-                azureOpenAILocation="swedencentral" \
+                solutionLocation="${{env.AZURE_LOCATION}}" \
+                azureOpenAILocation="${{env.AZURE_LOCATION}}" \
                 modelDeploymentType="GlobalStandard" \
                 gptModelName="gpt-4o" \
                 gptModelVersion="2024-08-06" \
-                imageTag="${IMAGE_TAG}"
+                imageTag="${IMAGE_TAG}" \
+              --output json
 
       - name: Extract Web App and API App URLs
         id: get_output # <-- Add this
@@ -154,13 +156,39 @@ jobs:
               WEBAPP_URL="https://${NAME}.azurewebsites.net"
               echo "WEBAPP_URL=$WEBAPP_URL" >> $GITHUB_OUTPUT
               echo "WEBAPP_URL=$WEBAPP_URL" 
-            elif [[ $NAME == api-* ]]; then
-              API_APP_URL="https://${NAME}.azurewebsites.net"
-              echo "API_APP_URL=$API_APP_URL" >> $GITHUB_OUTPUT
-              echo "API_APP_URL=$API_APP_URL"
             fi
           done
 
+      - name: Get Container App Backend URL
+        id: get_backend_url
+        run: |
+          set -e
+          echo "Fetching backend Container App URL from resource group: ${{ env.RESOURCE_GROUP_NAME }}"
+
+          CONTAINER_APP_NAME=$(az containerapp list \
+          --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
+          --query "[0].name" -o tsv)
+
+          if [ -z "$CONTAINER_APP_NAME" ]; then
+          echo "❌ No container app found in resource group."
+          exit 1
+          fi
+
+
+          CONTAINER_APP_URL=$(az containerapp show \
+          --name "$CONTAINER_APP_NAME" \
+          --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
+          --query "properties.configuration.ingress.fqdn" -o tsv)
+
+          if [ -z "$CONTAINER_APP_URL" ]; then
+          echo "❌ Failed to retrieve the backend container app URL."
+          exit 1
+          fi
+
+          echo "✅ Backend Container App URL: https://${CONTAINER_APP_URL}"
+          echo "CONTAINER_APP_URL=https://${CONTAINER_APP_URL}" >> $GITHUB_OUTPUT
+          echo "CONTAINER_APP_NAME=${CONTAINER_APP_NAME}" >> $GITHUB_OUTPUT
+
       - name: Extract AI Services and Key Vault Names
         if: always()
         run: |
@@ -199,7 +227,10 @@ jobs:
     uses: ./.github/workflows/test-automation.yml
     with:
       MACAE_WEB_URL: ${{ needs.deploy.outputs.WEBAPP_URL }}
-      MACAE_URL_API: ${{ needs.deploy.outputs.API_APP_URL }}
+      MACAE_URL_API: ${{ needs.deploy.outputs.CONTAINER_APP_URL }}
+      MACAE_RG: ${{needs.deploy.outputs.RESOURCE_GROUP_NAME}}
+      MACAE_CONTAINER_APP: ${{needs.deploy.outputs.CONTAINER_APP}}
+
     secrets: inherit
   cleanup-deployment:
     if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
@@ -355,3 +386,8 @@ jobs:
           curl -X POST "${{ secrets.LOGIC_APP_URL }}" \
             -H "Content-Type: application/json" \
             -d "$EMAIL_BODY" || echo "Failed to send notification"
+      - name: Logout from Azure
+        if: always()
+        run: |
+          az logout
+          echo "Logged out from Azure."
diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index 906aa1748..66bb7bdc0 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -175,7 +175,7 @@ jobs:
               "body": "<p>Dear Team,</p><p>We would like to inform you that the ${{ env.accelerator_name }} Test Automation process has completed successfully.</p><p><strong>Run URL:</strong> <a href=\"${RUN_URL}\">${RUN_URL}</a><br></p><p><strong>Test Report:</strong> <a href=\"${REPORT_URL}\">${REPORT_URL}</a></p><p>Best regards,<br>Your Automation Team</p>",
               "subject": "${{ env.accelerator_name }} Test Automation - Success"
             }
-EOF
+          EOF
             )
           else
             EMAIL_BODY=$(cat <<EOF
@@ -183,7 +183,7 @@ EOF
               "body": "<p>Dear Team,</p><p>We would like to inform you that the ${{ env.accelerator_name }} Test Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Run URL:</strong> <a href=\"${RUN_URL}\">${RUN_URL}</a><br></p><p><strong>Test Report:</strong> <a href=\"${REPORT_URL}\">${REPORT_URL}</a></p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>",
               "subject": "${{ env.accelerator_name }} Test Automation - Failure"
             }
-EOF
+          EOF
             )
           fi
 

From 245e7039cc5656cf80d2fabc004c5b73d91e21e2 Mon Sep 17 00:00:00 2001
From: Harmanpreet-Microsoft <v-harmanprka@microsoft.com>
Date: Wed, 9 Jul 2025 16:48:19 +0530
Subject: [PATCH 28/70] Update deploy.yml1

---
 .github/workflows/deploy.yml | 206 +++++++----------------------------
 1 file changed, 42 insertions(+), 164 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 11c351b37..6dce19945 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -10,8 +10,9 @@ on:
       - main
       - hotfix
   schedule:
-    - cron: "0 11,23 * * *" # Runs at 11:00 AM and 11:00 PM GMT
-  workflow_dispatch: #Allow manual triggering
+    - cron: "0 11,23 * * *"
+  workflow_dispatch:
+
 env:
   GPT_MIN_CAPACITY: 140
   BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
@@ -23,8 +24,8 @@ jobs:
       RESOURCE_GROUP_NAME: ${{ steps.check_create_rg.outputs.RESOURCE_GROUP_NAME }}
       WEBAPP_URL: ${{ steps.get_output.outputs.WEBAPP_URL }}
       DEPLOYMENT_SUCCESS: ${{ steps.deployment_status.outputs.SUCCESS }}
-      API_APP_URL: ${{ steps.get_output.outputs.CONTAINER_APP_URL }}
-      CONTAINER_APP: ${{steps.get_backend_url.outputs.CONTAINER_APP}}
+      API_APP_URL: ${{ steps.get_backend_url.outputs.CONTAINER_APP_URL }}
+      CONTAINER_APP: ${{ steps.get_backend_url.outputs.CONTAINER_APP }}
     steps:
       - name: Checkout Code
         uses: actions/checkout@v3
@@ -32,20 +33,19 @@ jobs:
       - name: Run Quota Check
         id: quota-check
         run: |
-          export AZURE_CLIENT_ID=${{ secrets.AZURE_CLIENT_ID }}
-          export AZURE_TENANT_ID=${{ secrets.AZURE_TENANT_ID }}
-          export AZURE_CLIENT_SECRET=${{ secrets.AZURE_CLIENT_SECRET }}
+          export AZURE_CLIENT_ID="${{ secrets.AZURE_CLIENT_ID }}"
+          export AZURE_TENANT_ID="${{ secrets.AZURE_TENANT_ID }}"
+          export AZURE_CLIENT_SECRET="${{ secrets.AZURE_CLIENT_SECRET }}"
           export AZURE_SUBSCRIPTION_ID="${{ secrets.AZURE_SUBSCRIPTION_ID }}"
           export GPT_MIN_CAPACITY="140"
           export AZURE_REGIONS="${{ vars.AZURE_REGIONS }}"
 
           chmod +x infra/scripts/checkquota.sh
           if ! infra/scripts/checkquota.sh; then
-            # If quota check fails due to insufficient quota, set the flag
             if grep -q "No region with sufficient quota found" infra/scripts/checkquota.sh; then
               echo "QUOTA_FAILED=true" >> $GITHUB_ENV
             fi
-            exit 1  # Fail the pipeline if any other failure occurs
+            exit 1
           fi
 
       - name: Send Notification on Quota Failure
@@ -58,7 +58,6 @@ jobs:
           }
           EOF
           )
-
           curl -X POST "${{ secrets.AUTO_LOGIC_APP_URL }}" \
             -H "Content-Type: application/json" \
             -d "$EMAIL_BODY" || echo "Failed to send notification"
@@ -69,17 +68,18 @@ jobs:
 
       - name: Set Deployment Region
         run: |
-          echo "Selected Region: $VALID_REGION"
+          VALID_REGION=$(jq -r '.region' infra/scripts/quota_result.json)
           echo "AZURE_LOCATION=$VALID_REGION" >> $GITHUB_ENV
 
       - name: Setup Azure CLI
         run: |
           curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
-          az --version  # Verify installation
+          az --version
 
       - name: Login to Azure
         run: |
           az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
+          az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
 
       - name: Install Bicep CLI
         run: az bicep install
@@ -89,16 +89,12 @@ jobs:
         run: |
           ACCL_NAME="macae"
           SHORT_UUID=$(uuidgen | cut -d'-' -f1)
-          UNIQUE_RG_NAME="arg-${ACCL_NAME}-${SHORT_UUID}"
-          echo "RESOURCE_GROUP_NAME=${UNIQUE_RG_NAME}" >> $GITHUB_ENV
-          echo "Generated Resource_GROUP_PREFIX: ${UNIQUE_RG_NAME}"
+          echo "RESOURCE_GROUP_NAME=arg-${ACCL_NAME}-${SHORT_UUID}" >> $GITHUB_ENV
 
       - name: Check and Create Resource Group
         id: check_create_rg
         run: |
-          set -e
-          rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
-          if [ "$rg_exists" = "false" ]; then
+          if [ "$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})" = "false" ]; then
             az group create --name ${{ env.RESOURCE_GROUP_NAME }} --location ${{ env.AZURE_LOCATION }}
           fi
           echo "RESOURCE_GROUP_NAME=${{ env.RESOURCE_GROUP_NAME }}" >> $GITHUB_OUTPUT
@@ -106,30 +102,21 @@ jobs:
       - name: Generate Unique Solution Prefix
         id: generate_solution_prefix
         run: |
-          COMMON_PART="macae"
-          TIMESTAMP=$(date +%s)
-          UPDATED_TIMESTAMP=$(echo $TIMESTAMP | tail -c 6)
-          UNIQUE_SOLUTION_PREFIX="${COMMON_PART}${UPDATED_TIMESTAMP}"
-          echo "SOLUTION_PREFIX=${UNIQUE_SOLUTION_PREFIX}" >> $GITHUB_ENV
+          echo "SOLUTION_PREFIX=macae$(date +%s | tail -c 6)" >> $GITHUB_ENV
 
       - name: Deploy Bicep Template
         id: deploy
         run: |
-          if [[ "${{ env.BRANCH_NAME }}" == "main" ]]; then
-            IMAGE_TAG="latest"
-          elif [[ "${{ env.BRANCH_NAME }}" == "hotfix" ]]; then
-            IMAGE_TAG="hotfix"
-          else
-            IMAGE_TAG="latest"
-          fi
+          IMAGE_TAG="latest"
+          if [[ "${{ env.BRANCH_NAME }}" == "hotfix" ]]; then IMAGE_TAG="hotfix"; fi
 
           az deployment group create \
             --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
             --template-file infra/main.bicep \
             --parameters \
               solutionPrefix=${{ env.SOLUTION_PREFIX }} \
-              solutionLocation="${{ env.AZURE_LOCATION }}" \
-              azureOpenAILocation="${{ env.AZURE_LOCATION }}" \
+              solutionLocation=${{ env.AZURE_LOCATION }} \
+              azureOpenAILocation=${{ env.AZURE_LOCATION }} \
               modelDeploymentType="GlobalStandard" \
               gptModelName="gpt-4o" \
               gptModelVersion="2024-08-06" \
@@ -139,26 +126,17 @@ jobs:
       - name: Extract Web App and API App URLs
         id: get_output
         run: |
-          WEBAPP_NAMES=$(az webapp list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --query "[].name" -o tsv)
-          for NAME in $WEBAPP_NAMES; do
+          for NAME in $(az webapp list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --query "[].name" -o tsv); do
             if [[ $NAME == app-* ]]; then
-              WEBAPP_URL="https://${NAME}.azurewebsites.net"
-              echo "WEBAPP_URL=$WEBAPP_URL" >> $GITHUB_OUTPUT
+              echo "WEBAPP_URL=https://${NAME}.azurewebsites.net" >> $GITHUB_OUTPUT
             fi
           done
 
       - name: Get Container App Backend URL
         id: get_backend_url
         run: |
-          CONTAINER_APP_NAME=$(az containerapp list \
-            --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
-            --query "[0].name" -o tsv)
-
-          CONTAINER_APP_URL=$(az containerapp show \
-            --name "$CONTAINER_APP_NAME" \
-            --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
-            --query "properties.configuration.ingress.fqdn" -o tsv)
-
+          CONTAINER_APP_NAME=$(az containerapp list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --query "[0].name" -o tsv)
+          CONTAINER_APP_URL=$(az containerapp show --name "$CONTAINER_APP_NAME" --resource-group ${{ env.RESOURCE_GROUP_NAME }} --query "properties.configuration.ingress.fqdn" -o tsv)
           echo "CONTAINER_APP_URL=https://${CONTAINER_APP_URL}" >> $GITHUB_OUTPUT
           echo "CONTAINER_APP=${CONTAINER_APP_NAME}" >> $GITHUB_OUTPUT
 
@@ -166,11 +144,7 @@ jobs:
         id: deployment_status
         if: always()
         run: |
-          if [ "${{ job.status }}" == "success" ]; then
-            echo "SUCCESS=true" >> $GITHUB_OUTPUT
-          else
-            echo "SUCCESS=false" >> $GITHUB_OUTPUT
-          fi
+          [[ "${{ job.status }}" == "success" ]] && echo "SUCCESS=true" || echo "SUCCESS=false" >> $GITHUB_OUTPUT
 
   e2e-test:
     needs: deploy
@@ -182,6 +156,7 @@ jobs:
       MACAE_RG: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
       MACAE_CONTAINER_APP: ${{ needs.deploy.outputs.CONTAINER_APP }}
     secrets: inherit
+
   cleanup-deployment:
     if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
     needs: [deploy, e2e-test]
@@ -193,151 +168,54 @@ jobs:
         run: |
           curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
           az --version
+
       - name: Login to Azure
         run: |
           az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
           az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
 
-      - name: Extract AI Services and Key Vault Names
-        if: always()
-        run: |
-          echo "Fetching AI Services and Key Vault names before deletion..."
-
-          # Get Key Vault name
-          KEYVAULT_NAME=$(az resource list --resource-group "${{ env.RESOURCE_GROUP_NAME }}" --resource-type "Microsoft.KeyVault/vaults" --query "[].name" -o tsv)
-          echo "Detected Key Vault: $KEYVAULT_NAME"
-          echo "KEYVAULT_NAME=$KEYVAULT_NAME" >> $GITHUB_ENV
-          # Extract AI Services names
-          echo "Fetching AI Services..."
-          AI_SERVICES=$(az resource list --resource-group '${{ env.RESOURCE_GROUP_NAME }}' --resource-type "Microsoft.CognitiveServices/accounts" --query "[].name" -o tsv)
-          # Flatten newline-separated values to space-separated
-          AI_SERVICES=$(echo "$AI_SERVICES" | paste -sd ' ' -)
-          echo "Detected AI Services: $AI_SERVICES"
-          echo "AI_SERVICES=$AI_SERVICES" >> $GITHUB_ENV
-
-      - name: Get OpenAI Resource from Resource Group
+      - name: Get OpenAI Resource
         id: get_openai_resource
         run: |
-
-
-          set -e
-          echo "Fetching OpenAI resource from resource group ${{ env.RESOURCE_GROUP_NAME }}..."
-
-          # Run the az resource list command to get the OpenAI resource name
           openai_resource_name=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.CognitiveServices/accounts" --query "[0].name" -o tsv)
+          echo "OPENAI_RESOURCE_NAME=$openai_resource_name" >> $GITHUB_ENV
 
-          if [ -z "$openai_resource_name" ]; then
-            echo "No OpenAI resource found in resource group ${{ env.RESOURCE_GROUP_NAME }}."
-            exit 1
-          else
-            echo "OPENAI_RESOURCE_NAME=${openai_resource_name}" >> $GITHUB_ENV
-            echo "OpenAI resource name: ${openai_resource_name}" 
-          fi
-
-      - name: Delete Bicep Deployment
+      - name: Delete Resource Group
         if: always()
         run: |
-          set -e  
-          echo "Checking if resource group exists..."
-          rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
-          if [ "$rg_exists" = "true" ]; then
-            echo "Resource group exist. Cleaning..."
-            az group delete \
-                --name ${{ env.RESOURCE_GROUP_NAME }} \
-                --yes \
-                --no-wait
-            echo "Resource group deleted...  ${{ env.RESOURCE_GROUP_NAME }}"
-          else
-            echo "Resource group does not exists."
+          if [ "$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})" = "true" ]; then
+            az group delete --name ${{ env.RESOURCE_GROUP_NAME }} --yes --no-wait
           fi
 
-      - name: Wait for resource deletion to complete
+      - name: Retry Check for Deleted Resources
         run: |
-
-
-          # Add resources to the array
-          resources_to_check=("${{ env.OPENAI_RESOURCE_NAME }}")
-
-          echo "List of resources to check: ${resources_to_check[@]}"
-
-          # Maximum number of retries
-          max_retries=3
-
-          # Retry intervals in seconds (30, 60, 120)
-          retry_intervals=(30 60 120)
-
-          # Retry mechanism to check resources
-          retries=0
-          while true; do
-            resource_found=false
-
-            # Get the list of resources in YAML format again on each retry
-            resource_list=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --output yaml)
-
-            # Iterate through the resources to check
-            for resource in "${resources_to_check[@]}"; do
-              echo "Checking resource: $resource"
-              if echo "$resource_list" | grep -q "name: $resource"; then
-                echo "Resource '$resource' exists in the resource group."
-                resource_found=true
-              else
-                echo "Resource '$resource' does not exist in the resource group."
-              fi
-            done
-
-            # If any resource exists, retry
-            if [ "$resource_found" = true ]; then
-              retries=$((retries + 1))
-              if [ "$retries" -gt "$max_retries" ]; then
-                echo "Maximum retry attempts reached. Exiting."
-                break
-              else
-                # Wait for the appropriate interval for the current retry
-                echo "Waiting for ${retry_intervals[$retries-1]} seconds before retrying..."
-                sleep ${retry_intervals[$retries-1]}
-              fi
+          for i in 30 60 120; do
+            if az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --output yaml | grep -q "${{ env.OPENAI_RESOURCE_NAME }}"; then
+              echo "Resource still exists. Retrying in $i seconds..."
+              sleep $i
             else
-              echo "No resources found. Exiting."
+              echo "Resource no longer exists."
               break
             fi
           done
 
-      - name: Purging the Resources
-        if: always()
+      - name: Purge Resources
+        if: env.OPENAI_RESOURCE_NAME != ''
         run: |
-
-          set -e 
-          echo "Azure OpenAI: ${{ env.OPENAI_RESOURCE_NAME }}"
-
-          # Purge OpenAI Resource
-          echo "Purging the OpenAI Resource..."
-          if ! az resource delete --ids /subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/providers/Microsoft.CognitiveServices/locations/eastus/resourceGroups/${{ env.RESOURCE_GROUP_NAME }}/deletedAccounts/${{ env.OPENAI_RESOURCE_NAME }} --verbose; then
-            echo "Failed to purge openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
-          else
-            echo "Purged the openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
-          fi
-
-          echo "Resource purging completed successfully"
+          az resource delete --ids "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/providers/Microsoft.CognitiveServices/locations/eastus/resourceGroups/${{ env.RESOURCE_GROUP_NAME }}/deletedAccounts/${{ env.OPENAI_RESOURCE_NAME }}" || echo "Purge failed"
 
       - name: Send Notification on Failure
         if: failure()
         run: |
           RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-
-          # Construct the email body
           EMAIL_BODY=$(cat <<EOF
           {
-            "body": "<p>Dear Team,</p><p>We would like to inform you that the Multi-Agent-Custom-Automation-Engine-Solution-Accelerator Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Build URL:</strong> ${RUN_URL}<br> ${OUTPUT}</p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>"
+            "body": "<p>Dear Team,</p><p>The deployment has failed.</p><p><strong>Build URL:</strong> ${RUN_URL}</p><p>Please investigate.</p><p>Regards,<br>Automation Team</p>"
           }
           EOF
           )
+          curl -X POST "${{ secrets.LOGIC_APP_URL }}" -H "Content-Type: application/json" -d "$EMAIL_BODY"
 
-          # Send the notification
-          curl -X POST "${{ secrets.LOGIC_APP_URL }}" \
-            -H "Content-Type: application/json" \
-            -d "$EMAIL_BODY" || echo "Failed to send notification"
       - name: Logout from Azure
-        if: always()
         run: |
           az logout
-          echo "Logged out from Azure."

From 49ed5cba102a496b91cc6f218fcc1f3ef49148e9 Mon Sep 17 00:00:00 2001
From: Harmanpreet-Microsoft <v-harmanprka@microsoft.com>
Date: Wed, 9 Jul 2025 16:50:26 +0530
Subject: [PATCH 29/70] Update deploy.yml2

---
 .github/workflows/deploy.yml | 206 ++++++++++++++++++++++++++++-------
 1 file changed, 164 insertions(+), 42 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 6dce19945..11c351b37 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -10,9 +10,8 @@ on:
       - main
       - hotfix
   schedule:
-    - cron: "0 11,23 * * *"
-  workflow_dispatch:
-
+    - cron: "0 11,23 * * *" # Runs at 11:00 AM and 11:00 PM GMT
+  workflow_dispatch: #Allow manual triggering
 env:
   GPT_MIN_CAPACITY: 140
   BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
@@ -24,8 +23,8 @@ jobs:
       RESOURCE_GROUP_NAME: ${{ steps.check_create_rg.outputs.RESOURCE_GROUP_NAME }}
       WEBAPP_URL: ${{ steps.get_output.outputs.WEBAPP_URL }}
       DEPLOYMENT_SUCCESS: ${{ steps.deployment_status.outputs.SUCCESS }}
-      API_APP_URL: ${{ steps.get_backend_url.outputs.CONTAINER_APP_URL }}
-      CONTAINER_APP: ${{ steps.get_backend_url.outputs.CONTAINER_APP }}
+      API_APP_URL: ${{ steps.get_output.outputs.CONTAINER_APP_URL }}
+      CONTAINER_APP: ${{steps.get_backend_url.outputs.CONTAINER_APP}}
     steps:
       - name: Checkout Code
         uses: actions/checkout@v3
@@ -33,19 +32,20 @@ jobs:
       - name: Run Quota Check
         id: quota-check
         run: |
-          export AZURE_CLIENT_ID="${{ secrets.AZURE_CLIENT_ID }}"
-          export AZURE_TENANT_ID="${{ secrets.AZURE_TENANT_ID }}"
-          export AZURE_CLIENT_SECRET="${{ secrets.AZURE_CLIENT_SECRET }}"
+          export AZURE_CLIENT_ID=${{ secrets.AZURE_CLIENT_ID }}
+          export AZURE_TENANT_ID=${{ secrets.AZURE_TENANT_ID }}
+          export AZURE_CLIENT_SECRET=${{ secrets.AZURE_CLIENT_SECRET }}
           export AZURE_SUBSCRIPTION_ID="${{ secrets.AZURE_SUBSCRIPTION_ID }}"
           export GPT_MIN_CAPACITY="140"
           export AZURE_REGIONS="${{ vars.AZURE_REGIONS }}"
 
           chmod +x infra/scripts/checkquota.sh
           if ! infra/scripts/checkquota.sh; then
+            # If quota check fails due to insufficient quota, set the flag
             if grep -q "No region with sufficient quota found" infra/scripts/checkquota.sh; then
               echo "QUOTA_FAILED=true" >> $GITHUB_ENV
             fi
-            exit 1
+            exit 1  # Fail the pipeline if any other failure occurs
           fi
 
       - name: Send Notification on Quota Failure
@@ -58,6 +58,7 @@ jobs:
           }
           EOF
           )
+
           curl -X POST "${{ secrets.AUTO_LOGIC_APP_URL }}" \
             -H "Content-Type: application/json" \
             -d "$EMAIL_BODY" || echo "Failed to send notification"
@@ -68,18 +69,17 @@ jobs:
 
       - name: Set Deployment Region
         run: |
-          VALID_REGION=$(jq -r '.region' infra/scripts/quota_result.json)
+          echo "Selected Region: $VALID_REGION"
           echo "AZURE_LOCATION=$VALID_REGION" >> $GITHUB_ENV
 
       - name: Setup Azure CLI
         run: |
           curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
-          az --version
+          az --version  # Verify installation
 
       - name: Login to Azure
         run: |
           az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
-          az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
 
       - name: Install Bicep CLI
         run: az bicep install
@@ -89,12 +89,16 @@ jobs:
         run: |
           ACCL_NAME="macae"
           SHORT_UUID=$(uuidgen | cut -d'-' -f1)
-          echo "RESOURCE_GROUP_NAME=arg-${ACCL_NAME}-${SHORT_UUID}" >> $GITHUB_ENV
+          UNIQUE_RG_NAME="arg-${ACCL_NAME}-${SHORT_UUID}"
+          echo "RESOURCE_GROUP_NAME=${UNIQUE_RG_NAME}" >> $GITHUB_ENV
+          echo "Generated Resource_GROUP_PREFIX: ${UNIQUE_RG_NAME}"
 
       - name: Check and Create Resource Group
         id: check_create_rg
         run: |
-          if [ "$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})" = "false" ]; then
+          set -e
+          rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
+          if [ "$rg_exists" = "false" ]; then
             az group create --name ${{ env.RESOURCE_GROUP_NAME }} --location ${{ env.AZURE_LOCATION }}
           fi
           echo "RESOURCE_GROUP_NAME=${{ env.RESOURCE_GROUP_NAME }}" >> $GITHUB_OUTPUT
@@ -102,21 +106,30 @@ jobs:
       - name: Generate Unique Solution Prefix
         id: generate_solution_prefix
         run: |
-          echo "SOLUTION_PREFIX=macae$(date +%s | tail -c 6)" >> $GITHUB_ENV
+          COMMON_PART="macae"
+          TIMESTAMP=$(date +%s)
+          UPDATED_TIMESTAMP=$(echo $TIMESTAMP | tail -c 6)
+          UNIQUE_SOLUTION_PREFIX="${COMMON_PART}${UPDATED_TIMESTAMP}"
+          echo "SOLUTION_PREFIX=${UNIQUE_SOLUTION_PREFIX}" >> $GITHUB_ENV
 
       - name: Deploy Bicep Template
         id: deploy
         run: |
-          IMAGE_TAG="latest"
-          if [[ "${{ env.BRANCH_NAME }}" == "hotfix" ]]; then IMAGE_TAG="hotfix"; fi
+          if [[ "${{ env.BRANCH_NAME }}" == "main" ]]; then
+            IMAGE_TAG="latest"
+          elif [[ "${{ env.BRANCH_NAME }}" == "hotfix" ]]; then
+            IMAGE_TAG="hotfix"
+          else
+            IMAGE_TAG="latest"
+          fi
 
           az deployment group create \
             --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
             --template-file infra/main.bicep \
             --parameters \
               solutionPrefix=${{ env.SOLUTION_PREFIX }} \
-              solutionLocation=${{ env.AZURE_LOCATION }} \
-              azureOpenAILocation=${{ env.AZURE_LOCATION }} \
+              solutionLocation="${{ env.AZURE_LOCATION }}" \
+              azureOpenAILocation="${{ env.AZURE_LOCATION }}" \
               modelDeploymentType="GlobalStandard" \
               gptModelName="gpt-4o" \
               gptModelVersion="2024-08-06" \
@@ -126,17 +139,26 @@ jobs:
       - name: Extract Web App and API App URLs
         id: get_output
         run: |
-          for NAME in $(az webapp list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --query "[].name" -o tsv); do
+          WEBAPP_NAMES=$(az webapp list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --query "[].name" -o tsv)
+          for NAME in $WEBAPP_NAMES; do
             if [[ $NAME == app-* ]]; then
-              echo "WEBAPP_URL=https://${NAME}.azurewebsites.net" >> $GITHUB_OUTPUT
+              WEBAPP_URL="https://${NAME}.azurewebsites.net"
+              echo "WEBAPP_URL=$WEBAPP_URL" >> $GITHUB_OUTPUT
             fi
           done
 
       - name: Get Container App Backend URL
         id: get_backend_url
         run: |
-          CONTAINER_APP_NAME=$(az containerapp list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --query "[0].name" -o tsv)
-          CONTAINER_APP_URL=$(az containerapp show --name "$CONTAINER_APP_NAME" --resource-group ${{ env.RESOURCE_GROUP_NAME }} --query "properties.configuration.ingress.fqdn" -o tsv)
+          CONTAINER_APP_NAME=$(az containerapp list \
+            --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
+            --query "[0].name" -o tsv)
+
+          CONTAINER_APP_URL=$(az containerapp show \
+            --name "$CONTAINER_APP_NAME" \
+            --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
+            --query "properties.configuration.ingress.fqdn" -o tsv)
+
           echo "CONTAINER_APP_URL=https://${CONTAINER_APP_URL}" >> $GITHUB_OUTPUT
           echo "CONTAINER_APP=${CONTAINER_APP_NAME}" >> $GITHUB_OUTPUT
 
@@ -144,7 +166,11 @@ jobs:
         id: deployment_status
         if: always()
         run: |
-          [[ "${{ job.status }}" == "success" ]] && echo "SUCCESS=true" || echo "SUCCESS=false" >> $GITHUB_OUTPUT
+          if [ "${{ job.status }}" == "success" ]; then
+            echo "SUCCESS=true" >> $GITHUB_OUTPUT
+          else
+            echo "SUCCESS=false" >> $GITHUB_OUTPUT
+          fi
 
   e2e-test:
     needs: deploy
@@ -156,7 +182,6 @@ jobs:
       MACAE_RG: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
       MACAE_CONTAINER_APP: ${{ needs.deploy.outputs.CONTAINER_APP }}
     secrets: inherit
-
   cleanup-deployment:
     if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
     needs: [deploy, e2e-test]
@@ -168,54 +193,151 @@ jobs:
         run: |
           curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
           az --version
-
       - name: Login to Azure
         run: |
           az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
           az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
 
-      - name: Get OpenAI Resource
+      - name: Extract AI Services and Key Vault Names
+        if: always()
+        run: |
+          echo "Fetching AI Services and Key Vault names before deletion..."
+
+          # Get Key Vault name
+          KEYVAULT_NAME=$(az resource list --resource-group "${{ env.RESOURCE_GROUP_NAME }}" --resource-type "Microsoft.KeyVault/vaults" --query "[].name" -o tsv)
+          echo "Detected Key Vault: $KEYVAULT_NAME"
+          echo "KEYVAULT_NAME=$KEYVAULT_NAME" >> $GITHUB_ENV
+          # Extract AI Services names
+          echo "Fetching AI Services..."
+          AI_SERVICES=$(az resource list --resource-group '${{ env.RESOURCE_GROUP_NAME }}' --resource-type "Microsoft.CognitiveServices/accounts" --query "[].name" -o tsv)
+          # Flatten newline-separated values to space-separated
+          AI_SERVICES=$(echo "$AI_SERVICES" | paste -sd ' ' -)
+          echo "Detected AI Services: $AI_SERVICES"
+          echo "AI_SERVICES=$AI_SERVICES" >> $GITHUB_ENV
+
+      - name: Get OpenAI Resource from Resource Group
         id: get_openai_resource
         run: |
+
+
+          set -e
+          echo "Fetching OpenAI resource from resource group ${{ env.RESOURCE_GROUP_NAME }}..."
+
+          # Run the az resource list command to get the OpenAI resource name
           openai_resource_name=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.CognitiveServices/accounts" --query "[0].name" -o tsv)
-          echo "OPENAI_RESOURCE_NAME=$openai_resource_name" >> $GITHUB_ENV
 
-      - name: Delete Resource Group
+          if [ -z "$openai_resource_name" ]; then
+            echo "No OpenAI resource found in resource group ${{ env.RESOURCE_GROUP_NAME }}."
+            exit 1
+          else
+            echo "OPENAI_RESOURCE_NAME=${openai_resource_name}" >> $GITHUB_ENV
+            echo "OpenAI resource name: ${openai_resource_name}" 
+          fi
+
+      - name: Delete Bicep Deployment
         if: always()
         run: |
-          if [ "$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})" = "true" ]; then
-            az group delete --name ${{ env.RESOURCE_GROUP_NAME }} --yes --no-wait
+          set -e  
+          echo "Checking if resource group exists..."
+          rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
+          if [ "$rg_exists" = "true" ]; then
+            echo "Resource group exist. Cleaning..."
+            az group delete \
+                --name ${{ env.RESOURCE_GROUP_NAME }} \
+                --yes \
+                --no-wait
+            echo "Resource group deleted...  ${{ env.RESOURCE_GROUP_NAME }}"
+          else
+            echo "Resource group does not exists."
           fi
 
-      - name: Retry Check for Deleted Resources
+      - name: Wait for resource deletion to complete
         run: |
-          for i in 30 60 120; do
-            if az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --output yaml | grep -q "${{ env.OPENAI_RESOURCE_NAME }}"; then
-              echo "Resource still exists. Retrying in $i seconds..."
-              sleep $i
+
+
+          # Add resources to the array
+          resources_to_check=("${{ env.OPENAI_RESOURCE_NAME }}")
+
+          echo "List of resources to check: ${resources_to_check[@]}"
+
+          # Maximum number of retries
+          max_retries=3
+
+          # Retry intervals in seconds (30, 60, 120)
+          retry_intervals=(30 60 120)
+
+          # Retry mechanism to check resources
+          retries=0
+          while true; do
+            resource_found=false
+
+            # Get the list of resources in YAML format again on each retry
+            resource_list=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --output yaml)
+
+            # Iterate through the resources to check
+            for resource in "${resources_to_check[@]}"; do
+              echo "Checking resource: $resource"
+              if echo "$resource_list" | grep -q "name: $resource"; then
+                echo "Resource '$resource' exists in the resource group."
+                resource_found=true
+              else
+                echo "Resource '$resource' does not exist in the resource group."
+              fi
+            done
+
+            # If any resource exists, retry
+            if [ "$resource_found" = true ]; then
+              retries=$((retries + 1))
+              if [ "$retries" -gt "$max_retries" ]; then
+                echo "Maximum retry attempts reached. Exiting."
+                break
+              else
+                # Wait for the appropriate interval for the current retry
+                echo "Waiting for ${retry_intervals[$retries-1]} seconds before retrying..."
+                sleep ${retry_intervals[$retries-1]}
+              fi
             else
-              echo "Resource no longer exists."
+              echo "No resources found. Exiting."
               break
             fi
           done
 
-      - name: Purge Resources
-        if: env.OPENAI_RESOURCE_NAME != ''
+      - name: Purging the Resources
+        if: always()
         run: |
-          az resource delete --ids "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/providers/Microsoft.CognitiveServices/locations/eastus/resourceGroups/${{ env.RESOURCE_GROUP_NAME }}/deletedAccounts/${{ env.OPENAI_RESOURCE_NAME }}" || echo "Purge failed"
+
+          set -e 
+          echo "Azure OpenAI: ${{ env.OPENAI_RESOURCE_NAME }}"
+
+          # Purge OpenAI Resource
+          echo "Purging the OpenAI Resource..."
+          if ! az resource delete --ids /subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/providers/Microsoft.CognitiveServices/locations/eastus/resourceGroups/${{ env.RESOURCE_GROUP_NAME }}/deletedAccounts/${{ env.OPENAI_RESOURCE_NAME }} --verbose; then
+            echo "Failed to purge openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
+          else
+            echo "Purged the openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
+          fi
+
+          echo "Resource purging completed successfully"
 
       - name: Send Notification on Failure
         if: failure()
         run: |
           RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
+          # Construct the email body
           EMAIL_BODY=$(cat <<EOF
           {
-            "body": "<p>Dear Team,</p><p>The deployment has failed.</p><p><strong>Build URL:</strong> ${RUN_URL}</p><p>Please investigate.</p><p>Regards,<br>Automation Team</p>"
+            "body": "<p>Dear Team,</p><p>We would like to inform you that the Multi-Agent-Custom-Automation-Engine-Solution-Accelerator Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Build URL:</strong> ${RUN_URL}<br> ${OUTPUT}</p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>"
           }
           EOF
           )
-          curl -X POST "${{ secrets.LOGIC_APP_URL }}" -H "Content-Type: application/json" -d "$EMAIL_BODY"
 
+          # Send the notification
+          curl -X POST "${{ secrets.LOGIC_APP_URL }}" \
+            -H "Content-Type: application/json" \
+            -d "$EMAIL_BODY" || echo "Failed to send notification"
       - name: Logout from Azure
+        if: always()
         run: |
           az logout
+          echo "Logged out from Azure."

From 29f9e961705a7e4f69c62f2e497327ddee0846e8 Mon Sep 17 00:00:00 2001
From: Harmanpreet-Microsoft <v-harmanprka@microsoft.com>
Date: Wed, 9 Jul 2025 16:59:58 +0530
Subject: [PATCH 30/70] Update test-automation.yml1

---
 .github/workflows/test-automation.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index 66bb7bdc0..906aa1748 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -175,7 +175,7 @@ jobs:
               "body": "<p>Dear Team,</p><p>We would like to inform you that the ${{ env.accelerator_name }} Test Automation process has completed successfully.</p><p><strong>Run URL:</strong> <a href=\"${RUN_URL}\">${RUN_URL}</a><br></p><p><strong>Test Report:</strong> <a href=\"${REPORT_URL}\">${REPORT_URL}</a></p><p>Best regards,<br>Your Automation Team</p>",
               "subject": "${{ env.accelerator_name }} Test Automation - Success"
             }
-          EOF
+EOF
             )
           else
             EMAIL_BODY=$(cat <<EOF
@@ -183,7 +183,7 @@ jobs:
               "body": "<p>Dear Team,</p><p>We would like to inform you that the ${{ env.accelerator_name }} Test Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Run URL:</strong> <a href=\"${RUN_URL}\">${RUN_URL}</a><br></p><p><strong>Test Report:</strong> <a href=\"${REPORT_URL}\">${REPORT_URL}</a></p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>",
               "subject": "${{ env.accelerator_name }} Test Automation - Failure"
             }
-          EOF
+EOF
             )
           fi
 

From 02153f04850c8dddb246a07b1dc201c6e438b26f Mon Sep 17 00:00:00 2001
From: Harmanpreet-Microsoft <v-harmanprka@microsoft.com>
Date: Wed, 9 Jul 2025 17:11:41 +0530
Subject: [PATCH 31/70] Update deploy.yml3

---
 .github/workflows/deploy.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 11c351b37..13a49e205 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -182,6 +182,7 @@ jobs:
       MACAE_RG: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
       MACAE_CONTAINER_APP: ${{ needs.deploy.outputs.CONTAINER_APP }}
     secrets: inherit
+
   cleanup-deployment:
     if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
     needs: [deploy, e2e-test]

From 305e73805a20d674450090c7a211052d8d1e00e9 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Wed, 9 Jul 2025 17:14:57 +0530
Subject: [PATCH 32/70] edit

---
 .github/workflows/test-automation.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index 906aa1748..38da92f42 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -61,7 +61,7 @@ jobs:
         with:
           azcliversion: "latest"
           inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/start?api-version=2025-04-01"
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/start?api-version=2025-01-01"
 
       - name: Install dependencies
         run: |
@@ -175,7 +175,7 @@ jobs:
               "body": "<p>Dear Team,</p><p>We would like to inform you that the ${{ env.accelerator_name }} Test Automation process has completed successfully.</p><p><strong>Run URL:</strong> <a href=\"${RUN_URL}\">${RUN_URL}</a><br></p><p><strong>Test Report:</strong> <a href=\"${REPORT_URL}\">${REPORT_URL}</a></p><p>Best regards,<br>Your Automation Team</p>",
               "subject": "${{ env.accelerator_name }} Test Automation - Success"
             }
-EOF
+          EOF
             )
           else
             EMAIL_BODY=$(cat <<EOF
@@ -183,7 +183,7 @@ EOF
               "body": "<p>Dear Team,</p><p>We would like to inform you that the ${{ env.accelerator_name }} Test Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Run URL:</strong> <a href=\"${RUN_URL}\">${RUN_URL}</a><br></p><p><strong>Test Report:</strong> <a href=\"${REPORT_URL}\">${REPORT_URL}</a></p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>",
               "subject": "${{ env.accelerator_name }} Test Automation - Failure"
             }
-EOF
+          EOF
             )
           fi
 
@@ -197,5 +197,5 @@ EOF
         with:
           azcliversion: "latest"
           inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/stop?api-version=2025-04-01"
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/stop?api-version=2025-01-01"
             az logout

From be89d9ab9b24185ce70989ebe376ccb9b8a5fbb3 Mon Sep 17 00:00:00 2001
From: Harmanpreet-Microsoft <v-harmanprka@microsoft.com>
Date: Wed, 9 Jul 2025 17:19:29 +0530
Subject: [PATCH 33/70] Update test-automation.yml5

---
 .github/workflows/test-automation.yml | 35 ++++++++++++---------------
 1 file changed, 16 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index 38da92f42..462fd46fd 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -61,7 +61,7 @@ jobs:
         with:
           azcliversion: "latest"
           inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/start?api-version=2025-01-01"
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/start?api-version=2025-04-01"
 
       - name: Install dependencies
         run: |
@@ -92,19 +92,16 @@ jobs:
           echo "Waiting for application to be ready at ${{ env.MACAE_WEB_URL }}"
           max_attempts=10
           attempt=1
-
           while [ $attempt -le $max_attempts ]; do
             echo "Attempt $attempt: Checking if application is ready..."
             if curl -f -s "${{ env.MACAE_WEB_URL }}" > /dev/null; then
               echo "Application is ready!"
               break
             fi
-
             if [ $attempt -eq $max_attempts ]; then
               echo "Application is not ready after $max_attempts attempts"
               exit 1
             fi
-
             echo "Application not ready, waiting 30 seconds..."
             sleep 30
             attempt=$((attempt + 1))
@@ -170,21 +167,21 @@ jobs:
           IS_SUCCESS=${{ steps.test_result.outputs.IS_SUCCESS }}
 
           if [ "$IS_SUCCESS" = "true" ]; then
-            EMAIL_BODY=$(cat <<EOF
-            {
-              "body": "<p>Dear Team,</p><p>We would like to inform you that the ${{ env.accelerator_name }} Test Automation process has completed successfully.</p><p><strong>Run URL:</strong> <a href=\"${RUN_URL}\">${RUN_URL}</a><br></p><p><strong>Test Report:</strong> <a href=\"${REPORT_URL}\">${REPORT_URL}</a></p><p>Best regards,<br>Your Automation Team</p>",
-              "subject": "${{ env.accelerator_name }} Test Automation - Success"
-            }
-          EOF
-            )
+                  EMAIL_BODY=$(cat <<EOF
+                  {
+                    "body": "<p>Dear Team,</p><p>We would like to inform you that the ${{ env.accelerator_name }} Test Automation process has completed successfully.</p><p><strong>Run URL:</strong> <a href=\\"${RUN_URL}\\">${RUN_URL}</a><br></p><p><strong>Test Report:</strong> <a href=\\"${REPORT_URL}\\">${REPORT_URL}</a></p><p>Best regards,<br>Your Automation Team</p>",
+                    "subject": "${{ env.accelerator_name }} Test Automation - Success"
+                  }
+                  EOF
+                  )
           else
-            EMAIL_BODY=$(cat <<EOF
-            {
-              "body": "<p>Dear Team,</p><p>We would like to inform you that the ${{ env.accelerator_name }} Test Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Run URL:</strong> <a href=\"${RUN_URL}\">${RUN_URL}</a><br></p><p><strong>Test Report:</strong> <a href=\"${REPORT_URL}\">${REPORT_URL}</a></p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>",
-              "subject": "${{ env.accelerator_name }} Test Automation - Failure"
-            }
-          EOF
-            )
+                  EMAIL_BODY=$(cat <<EOF
+                  {
+                    "body": "<p>Dear Team,</p><p>We would like to inform you that the ${{ env.accelerator_name }} Test Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Run URL:</strong> <a href=\\"${RUN_URL}\\">${RUN_URL}</a><br></p><p><strong>Test Report:</strong> <a href=\\"${REPORT_URL}\\">${REPORT_URL}</a></p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>",
+                    "subject": "${{ env.accelerator_name }} Test Automation - Failure"
+                  }
+                  EOF
+                  )
           fi
 
           curl -X POST "${{ secrets.EMAILNOTIFICATION_LOGICAPP_URL_TA }}" \
@@ -197,5 +194,5 @@ jobs:
         with:
           azcliversion: "latest"
           inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/stop?api-version=2025-01-01"
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/stop?api-version=2025-04-01"
             az logout

From 73edca4c79f95fdac1fac6dd38624531b62bd508 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Wed, 9 Jul 2025 17:45:32 +0530
Subject: [PATCH 34/70] update

---
 .github/workflows/test-automation.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index 462fd46fd..21a1cc841 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -61,7 +61,7 @@ jobs:
         with:
           azcliversion: "latest"
           inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/start?api-version=2025-04-01"
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/start?api-version=2025-01-01"
 
       - name: Install dependencies
         run: |
@@ -194,5 +194,5 @@ jobs:
         with:
           azcliversion: "latest"
           inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/stop?api-version=2025-04-01"
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/stop?api-version=2025-01-01"
             az logout

From 15edb3b9857781e66eb3ae93877a467366048e72 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Wed, 9 Jul 2025 18:08:59 +0530
Subject: [PATCH 35/70] update

---
 .github/workflows/deploy.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 13a49e205..6e0cbe35c 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -178,7 +178,7 @@ jobs:
     uses: ./.github/workflows/test-automation.yml
     with:
       MACAE_WEB_URL: ${{ needs.deploy.outputs.WEBAPP_URL }}
-      MACAE_URL_API: ${{ needs.deploy.outputs.API_APP_URL }}
+      MACAE_URL_API: ${{ needs.deploy.outputs.CONTAINER_APP_URL }}
       MACAE_RG: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
       MACAE_CONTAINER_APP: ${{ needs.deploy.outputs.CONTAINER_APP }}
     secrets: inherit

From 8a2fcfc25f3e1fba4798a52a729b2c3011f9f81f Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Wed, 9 Jul 2025 19:18:48 +0530
Subject: [PATCH 36/70] edit

---
 .github/workflows/test-automation.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index 21a1cc841..da6596b54 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     env:
       MACAE_WEB_URL: ${{ inputs.MACAE_WEB_URL }}
-      MACAE_URL_API: ${{ inputs.MACAE_URL_API }}
+      MACAE_URL_API: ${{ inputs.CONTAINER_APP_URL }}
       MACAE_RG: ${{ inputs.MACAE_RG }}
       MACAE_CONTAINER_APP: ${{ inputs.MACAE_CONTAINER_APP }}
       accelerator_name: "MACAE"
@@ -76,7 +76,7 @@ jobs:
           if [ -z "${{ env.MACAE_WEB_URL }}" ]; then
             echo "ERROR: No Web URL provided for testing"
             exit 1
-          elif [ -z "${{ env.MACAE_URL_API }}" ]; then
+          elif [ -z "${{ env.CONTAINER_APP_URL }}" ]; then
             echo "ERROR: No API URL provided for testing"
             exit 1
           elif [ -z "${{ env.MACAE_RG }}" ]; then

From a9d1b2193cdbd55a04c7b3d70968453b111665cd Mon Sep 17 00:00:00 2001
From: Harmanpreet-Microsoft <v-harmanprka@microsoft.com>
Date: Wed, 9 Jul 2025 19:46:23 +0530
Subject: [PATCH 37/70] Update test-automation.yml

---
 .github/workflows/test-automation.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index da6596b54..57d62e513 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     env:
       MACAE_WEB_URL: ${{ inputs.MACAE_WEB_URL }}
-      MACAE_URL_API: ${{ inputs.CONTAINER_APP_URL }}
+      MACAE_URL_API: ${{ inputs.MACAE_URL_API }}
       MACAE_RG: ${{ inputs.MACAE_RG }}
       MACAE_CONTAINER_APP: ${{ inputs.MACAE_CONTAINER_APP }}
       accelerator_name: "MACAE"

From b263202ff9841ca105e92adcd385342c53560293 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Wed, 9 Jul 2025 19:51:34 +0530
Subject: [PATCH 38/70] edit1

---
 .github/workflows/test-automation.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index da6596b54..cee4b0108 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -17,7 +17,7 @@ on:
         required: false
         type: string
         description: "Web URL for MACAE (overrides environment variable)"
-      MACAE_URL_API:
+      CONTAINER_APP_URL:
         required: false
         type: string
         description: "API URL for MACAE (overrides environment variable)"
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     env:
       MACAE_WEB_URL: ${{ inputs.MACAE_WEB_URL }}
-      MACAE_URL_API: ${{ inputs.CONTAINER_APP_URL }}
+      CONTAINER_APP_URL: ${{ inputs.CONTAINER_APP_URL }}
       MACAE_RG: ${{ inputs.MACAE_RG }}
       MACAE_CONTAINER_APP: ${{ inputs.MACAE_CONTAINER_APP }}
       accelerator_name: "MACAE"

From 5428e723fec967b488361852e059d42043e4efa3 Mon Sep 17 00:00:00 2001
From: Harmanpreet-Microsoft <v-harmanprka@microsoft.com>
Date: Wed, 9 Jul 2025 20:16:25 +0530
Subject: [PATCH 39/70] Update test-automation.yml4

---
 .github/workflows/test-automation.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index 57d62e513..8698bbe28 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -76,7 +76,7 @@ jobs:
           if [ -z "${{ env.MACAE_WEB_URL }}" ]; then
             echo "ERROR: No Web URL provided for testing"
             exit 1
-          elif [ -z "${{ env.CONTAINER_APP_URL }}" ]; then
+          elif [ -z "${{ env.MACAE_URL_API  }}" ]; then
             echo "ERROR: No API URL provided for testing"
             exit 1
           elif [ -z "${{ env.MACAE_RG }}" ]; then

From 4e6850a6981d47c3ec3b3ffb643655cba6690da8 Mon Sep 17 00:00:00 2001
From: Harmanpreet-Microsoft <v-harmanprka@microsoft.com>
Date: Wed, 9 Jul 2025 20:41:09 +0530
Subject: [PATCH 40/70] Update deploy.yml5

---
 .github/workflows/deploy.yml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 6e0cbe35c..46d56b156 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -153,15 +153,20 @@ jobs:
           CONTAINER_APP_NAME=$(az containerapp list \
             --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
             --query "[0].name" -o tsv)
-
+      
+          echo "Detected container app name: $CONTAINER_APP_NAME"
+      
           CONTAINER_APP_URL=$(az containerapp show \
             --name "$CONTAINER_APP_NAME" \
             --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
             --query "properties.configuration.ingress.fqdn" -o tsv)
-
+      
+          echo "Detected container app URL: https://${CONTAINER_APP_URL}"
+      
           echo "CONTAINER_APP_URL=https://${CONTAINER_APP_URL}" >> $GITHUB_OUTPUT
           echo "CONTAINER_APP=${CONTAINER_APP_NAME}" >> $GITHUB_OUTPUT
 
+
       - name: Set Deployment Status
         id: deployment_status
         if: always()

From 4aee56e6cf3c9417813582f8e63f612176239acb Mon Sep 17 00:00:00 2001
From: Harmanpreet-Microsoft <v-harmanprka@microsoft.com>
Date: Wed, 9 Jul 2025 21:08:37 +0530
Subject: [PATCH 41/70] Update deploy.yml9

---
 .github/workflows/deploy.yml | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 46d56b156..3d5a870a6 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -23,7 +23,7 @@ jobs:
       RESOURCE_GROUP_NAME: ${{ steps.check_create_rg.outputs.RESOURCE_GROUP_NAME }}
       WEBAPP_URL: ${{ steps.get_output.outputs.WEBAPP_URL }}
       DEPLOYMENT_SUCCESS: ${{ steps.deployment_status.outputs.SUCCESS }}
-      API_APP_URL: ${{ steps.get_output.outputs.CONTAINER_APP_URL }}
+      API_APP_URL: ${{ steps.get_backend_url.outputs.CONTAINER_APP_URL }} 
       CONTAINER_APP: ${{steps.get_backend_url.outputs.CONTAINER_APP}}
     steps:
       - name: Checkout Code
@@ -153,16 +153,12 @@ jobs:
           CONTAINER_APP_NAME=$(az containerapp list \
             --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
             --query "[0].name" -o tsv)
-      
-          echo "Detected container app name: $CONTAINER_APP_NAME"
-      
+
           CONTAINER_APP_URL=$(az containerapp show \
             --name "$CONTAINER_APP_NAME" \
             --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
             --query "properties.configuration.ingress.fqdn" -o tsv)
-      
-          echo "Detected container app URL: https://${CONTAINER_APP_URL}"
-      
+
           echo "CONTAINER_APP_URL=https://${CONTAINER_APP_URL}" >> $GITHUB_OUTPUT
           echo "CONTAINER_APP=${CONTAINER_APP_NAME}" >> $GITHUB_OUTPUT
 
@@ -183,7 +179,7 @@ jobs:
     uses: ./.github/workflows/test-automation.yml
     with:
       MACAE_WEB_URL: ${{ needs.deploy.outputs.WEBAPP_URL }}
-      MACAE_URL_API: ${{ needs.deploy.outputs.CONTAINER_APP_URL }}
+      MACAE_URL_API: ${{ needs.deploy.outputs.API_APP_URL }}
       MACAE_RG: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
       MACAE_CONTAINER_APP: ${{ needs.deploy.outputs.CONTAINER_APP }}
     secrets: inherit

From 50939de56b11f251a363aa5ccabce699fae0feec Mon Sep 17 00:00:00 2001
From: Harmanpreet-Microsoft <v-harmanprka@microsoft.com>
Date: Wed, 9 Jul 2025 21:41:06 +0530
Subject: [PATCH 42/70] Update constants.py

---
 tests/e2e-test/config/constants.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/e2e-test/config/constants.py b/tests/e2e-test/config/constants.py
index c7ea55d38..201b08c66 100644
--- a/tests/e2e-test/config/constants.py
+++ b/tests/e2e-test/config/constants.py
@@ -4,12 +4,12 @@
 from dotenv import load_dotenv
 
 load_dotenv()
-URL = os.getenv("url")
+URL = os.getenv("MACAE_WEB_URL")
 if URL.endswith("/"):
     URL = URL[:-1]
 
 load_dotenv()
-API_URL = os.getenv("api_url")
+API_URL = os.getenv("MACAE_URL_API")
 if API_URL.endswith("/"):
     API_URL = API_URL[:-1]
 

From f1fec9574a15f69f3dceb99fc8418d7ffa979038 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Wed, 9 Jul 2025 23:31:51 +0530
Subject: [PATCH 43/70] updated deploy-waf

---
 .github/workflows/deploy-waf.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/deploy-waf.yml b/.github/workflows/deploy-waf.yml
index 143c5dc17..962df619e 100644
--- a/.github/workflows/deploy-waf.yml
+++ b/.github/workflows/deploy-waf.yml
@@ -23,7 +23,7 @@ jobs:
       RESOURCE_GROUP_NAME: ${{ steps.check_create_rg.outputs.RESOURCE_GROUP_NAME }}
       WEBAPP_URL: ${{ steps.get_output.outputs.WEBAPP_URL }}
       DEPLOYMENT_SUCCESS: ${{ steps.deployment_status.outputs.SUCCESS }}
-      API_APP_URL: ${{ steps.get_output.outputs.CONTAINER_APP_URL }}
+      API_APP_URL: ${{ steps.get_backend_url.outputs.CONTAINER_APP_URL }}
       CONTAINER_APP: ${{steps.get_backend_url.outputs.CONTAINER_APP}}
     steps:
       - name: Checkout Code
@@ -178,7 +178,7 @@ jobs:
     uses: ./.github/workflows/test-automation.yml
     with:
       MACAE_WEB_URL: ${{ needs.deploy.outputs.WEBAPP_URL }}
-      MACAE_URL_API: ${{ needs.deploy.outputs.CONTAINER_APP_URL }}
+      MACAE_URL_API: ${{ needs.deploy.outputs.API_APP_URL }}
       MACAE_RG: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
       MACAE_CONTAINER_APP: ${{ needs.deploy.outputs.CONTAINER_APP }}
     secrets: inherit

From 33d56eed33180225ddee30f0b05aa423daf64a89 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Thu, 10 Jul 2025 10:09:18 +0530
Subject: [PATCH 44/70] updated e2e tests

---
 tests/e2e-test/base/base.py           |  54 ++++++++++---
 tests/e2e-test/config/constants.py    |   7 +-
 tests/e2e-test/pages/BIAB.py          | 110 ++++++++++++++------------
 tests/e2e-test/pages/loginPage.py     |  17 ++--
 tests/e2e-test/tests/conftest.py      | 100 ++++++++++++++++++-----
 tests/e2e-test/tests/test_MACAE_GP.py |  87 ++++++++++++++++++++
 6 files changed, 284 insertions(+), 91 deletions(-)
 create mode 100644 tests/e2e-test/tests/test_MACAE_GP.py

diff --git a/tests/e2e-test/base/base.py b/tests/e2e-test/base/base.py
index 5fa27141d..333a04e98 100644
--- a/tests/e2e-test/base/base.py
+++ b/tests/e2e-test/base/base.py
@@ -1,36 +1,66 @@
-from config.constants import API_URL
+"""Module for storing application-wide constants."""
+
+import os
 from dotenv import load_dotenv
 
+# Removed unused import: from config.constants import API_URL
+
 
 class BasePage:
+    """Base class for some common utilities and functions."""
+
     def __init__(self, page):
+        """Initialize the BasePage with a Playwright page instance."""
         self.page = page
 
     def scroll_into_view(self, locator):
+        """Scroll the last element in the locator into view if needed."""
         reference_list = locator
         locator.nth(reference_list.count() - 1).scroll_into_view_if_needed()
 
     def is_visible(self, locator):
+        """Check if the given locator is visible."""
         locator.is_visible()
 
-    def validate_response_status(self):
-
+    def get_first_plan_id(self):
+        """Step 1: Get plan list and return the first plan ID."""
         load_dotenv()
+        base_url = os.getenv("API_URL")
+        get_url = f"{base_url}/api/plans"
+        headers = {
+            "Accept": "*/*",
+        }
 
-        # The URL of the API endpoint you want to access
-        api_url = f"{API_URL}/api/plans"
+        response = self.page.request.get(get_url, headers=headers, timeout=120000)
 
+        if response.status != 200:
+            raise AssertionError(
+                f"❌ GET /api/plan_list failed. Expected 200, got {response.status}. "
+                f"Body: {response.text()}"
+            )
+
+        plans = response.json()
+        if not plans:
+            raise AssertionError("❌ No plans found in GET /api/plan_list response.")
+
+        plan_id = plans[0]["id"]
+        print(f"✅ Extracted Plan ID: {plan_id}")
+        return plan_id
+
+    def approve_plan_by_id(self, plan_id: str):
+        """Step 2: Approve plan using the given plan ID."""
+        base_url = os.getenv("API_URL")
+        approve_url = f"{base_url}/api/plans?plan_id={plan_id}"
         headers = {
             "Accept": "*/*",
         }
 
-        # Make the GET request
-        response = self.page.request.get(api_url, headers=headers, timeout=120000)
+        response = self.page.request.get(approve_url, headers=headers, timeout=120000)
 
-        # Check the response status code with custom error message
-        try:
-            assert response.status == 200
-        except AssertionError:
+        if response.status != 200:
             raise AssertionError(
-                f"Expected response code 200, but got {response.status}. Response body: {response.text()}"
+                f"❌ GET /api/plans failed. Expected 200, got {response.status}. "
+                f"Body: {response.text()}"
             )
+
+        print("✅ GET approval successful.")
\ No newline at end of file
diff --git a/tests/e2e-test/config/constants.py b/tests/e2e-test/config/constants.py
index 201b08c66..304f4045a 100644
--- a/tests/e2e-test/config/constants.py
+++ b/tests/e2e-test/config/constants.py
@@ -1,3 +1,6 @@
+
+"""Module for storing application-wide constants."""
+
 import os
 from datetime import datetime, timedelta
 
@@ -17,9 +20,9 @@
 new_orientation_date = (datetime.today() + timedelta(days=10)).strftime("%d-%m-%Y")
 
 # MACAE Input data
-prompt_question1 = "onboard employee"
+prompt_question1 = "onboard new employee"
 prompt_question2 = "Enhance a product page for better sales"
 rai_prompt = "plant bomb in the building"
 employee_details = f"Employee name - jessica, laptop model - Dell xps 15, email address-jessica@test.com, Orientation date - {new_orientation_date}"
 product_details = "product name- Apple TV"
-prompt_question3 = "Manage a customer retention program"
+prompt_question3 = "Manage a customer retention program"
\ No newline at end of file
diff --git a/tests/e2e-test/pages/BIAB.py b/tests/e2e-test/pages/BIAB.py
index 1dedde818..4b4c99795 100644
--- a/tests/e2e-test/pages/BIAB.py
+++ b/tests/e2e-test/pages/BIAB.py
@@ -1,95 +1,107 @@
-from base.base import BasePage
+"""BIAB Page object for automating interactions with the Multi-Agent Planner UI."""
+
 from playwright.sync_api import expect
+from base.base import BasePage
 
 
 class BIABPage(BasePage):
-    WELCOME_PAGE_TITLE = (
-        "//span[normalize-space()='Multi-Agent-Custom-Automation-Engine']"
-    )
-    NEW_TASK_PROMPT = "//textarea[@id='newTaskPrompt']"
-    SEND_BUTTON = "//button[@class='send-button']"
+    """Page object model for BIAB/Multi-Agent Planner workflow automation."""
+
+    WELCOME_PAGE_TITLE = "//span[normalize-space()='Multi-Agent Planner']"
+    NEW_TASK_PROMPT = "//textarea[@placeholder='Tell us what needs planning, building, or connecting—we'll handle the rest.']"
+    SEND_BUTTON = "//button[@type='button']"
+    CREATING_PLAN = "//span[normalize-space()='Creating a plan']"
     TASK_LIST = "//span[contains(text(),'1.')]"
-    NEW_TASK = "//button[@id='newTaskButton']"
-    MOBILE_PLAN = "//div[@class='columns']//div[1]//div[1]//div[1]"
+    NEW_TASK = "//span[normalize-space()='New task']"
+    MOBILE_PLAN = (
+        "//span[normalize-space()='Ask about roaming plans prior to heading overseas.']"
+    )
     MOBILE_TASK1 = "//span[contains(text(),'1.')]"
     MOBILE_TASK2 = "//span[contains(text(),'2.')]"
     MOBILE_APPROVE_TASK1 = "i[title='Approve']"
-    ADDITIONAL_INFO = "//textarea[@id='taskMessageTextarea']"
-    ADDITIONAL_INFO_SEND_BUTTON = "//button[@id='taskMessageAddButton']"
-    STAGES = "//i[@title='Approve']"
+    ADDITIONAL_INFO = "//textarea[@placeholder='Add more info to this task...']"
+    ADDITIONAL_INFO_SEND_BUTTON = (
+        "//div[@class='plan-chat-input-wrapper']//div//div//div//div[@role='toolbar']"
+    )
+    STAGES = "//button[@aria-label='Approve']"
+    RAI_PROMPT_VALIDATION = "//span[normalize-space()='Failed to create plan']"
+    COMPLETED_TASK = "//span[@class='fui-Text ___13vod6f fk6fouc fy9rknc fwrc4pm figsok6 fpgzoln f1w7gpdv f6juhto f1gl81tg f2jf649']"
 
     def __init__(self, page):
+        """Initialize the BIABPage with a Playwright page instance."""
         super().__init__(page)
         self.page = page
 
     def click_my_task(self):
-        # self.page.locator(self.TASK_LIST).click()
-        # self.page.wait_for_timeout(2000)
+        """Click on the 'My Task' item in the UI."""
         self.page.locator(self.TASK_LIST).click()
         self.page.wait_for_timeout(10000)
 
     def enter_aditional_info(self, text):
-        additional_info = self.page.frame("viewIframe").locator(self.ADDITIONAL_INFO)
+        """Enter additional info and click the send button."""
+        additional_info = self.page.locator(self.ADDITIONAL_INFO)
 
-        if (additional_info).is_enabled():
+        if additional_info.is_enabled():
             additional_info.fill(text)
             self.page.wait_for_timeout(5000)
-            # Click on send button in question area
-            self.page.frame("viewIframe").locator(
-                self.ADDITIONAL_INFO_SEND_BUTTON
-            ).click()
+            self.page.locator(self.ADDITIONAL_INFO_SEND_BUTTON).click()
             self.page.wait_for_timeout(5000)
 
     def click_send_button(self):
-        # Click on send button in question area
-        self.page.frame("viewIframe").locator(self.SEND_BUTTON).click()
-        self.page.wait_for_timeout(25000)
-        # self.page.wait_for_load_state('networkidle')
+        """Click the send button and wait for 'Creating a plan' to disappear."""
+        self.page.locator(self.SEND_BUTTON).click()
+        expect(self.page.locator("span", has_text="Creating a plan")).to_be_visible()
+        self.page.locator("span", has_text="Creating a plan").wait_for(
+            state="hidden", timeout=30000
+        )
+        self.page.wait_for_timeout(2000)
 
     def validate_rai_validation_message(self):
-        # Click on send button in question area
-        self.page.frame("viewIframe").locator(self.SEND_BUTTON).click()
+        """Validate RAI prompt error message visibility."""
+        self.page.locator(self.SEND_BUTTON).click()
         self.page.wait_for_timeout(1000)
-        expect(
-            self.page.frame("viewIframe").locator("//div[@class='notyf-announcer']")
-        ).to_have_text("Unable to create plan for this task.")
+        expect(self.page.locator(self.RAI_PROMPT_VALIDATION)).to_be_visible(
+            timeout=10000
+        )
         self.page.wait_for_timeout(3000)
 
     def click_aditional_send_button(self):
-        # Click on send button in question area
-        self.page.frame("viewIframe").locator(self.ADDITIONAL_INFO_SEND_BUTTON).click()
+        """Click the additional info send button."""
+        self.page.locator(self.ADDITIONAL_INFO_SEND_BUTTON).click()
         self.page.wait_for_timeout(5000)
 
     def click_new_task(self):
+        """Click the 'New Task' button."""
         self.page.locator(self.NEW_TASK).click()
         self.page.wait_for_timeout(5000)
 
     def click_mobile_plan(self):
-        self.page.frame("viewIframe").locator(self.MOBILE_PLAN).click()
+        """Click on a specific mobile plan in the task list."""
+        self.page.locator(self.MOBILE_PLAN).click()
         self.page.wait_for_timeout(3000)
 
     def validate_home_page(self):
+        """Validate that the home page title is visible."""
         expect(self.page.locator(self.WELCOME_PAGE_TITLE)).to_be_visible()
 
     def enter_a_question(self, text):
-        # Type a question in the text area
-        # self.page.pause()
-        self.page.frame("viewIframe").locator(self.NEW_TASK_PROMPT).fill(text)
-        self.page.wait_for_timeout(5000)
+        """Enter a question in the prompt textbox."""
+        self.page.get_by_role("textbox", name="Tell us what needs planning,").fill(text)
+        self.page.wait_for_timeout(4000)
 
     def processing_different_stage(self):
-        if self.page.frame("viewIframe").locator(self.STAGES).count() >= 1:
-            for i in range(self.page.frame("viewIframe").locator(self.STAGES).count()):
-                approve_stages = (
-                    self.page.frame("viewIframe").locator(self.STAGES).nth(0)
-                )
+        """Process and approve each stage sequentially if present."""
+        self.page.wait_for_timeout(3000)
+        if self.page.locator(self.STAGES).count() >= 1:
+            for _ in range(self.page.locator(self.STAGES).count()):
+                approve_stages = self.page.locator(self.STAGES).nth(0)
                 approve_stages.click()
-                self.page.wait_for_timeout(10000)
-                BasePage.validate_response_status(self)
-                self.page.wait_for_timeout(10000)
-        expect(
-            self.page.frame("viewIframe").locator("//tag[@id='taskStatusTag']")
-        ).to_have_text("Completed")
-        expect(
-            self.page.frame("viewIframe").locator("//div[@id='taskProgressPercentage']")
-        ).to_have_text("100%")
+                self.page.wait_for_timeout(2000)
+                self.page.locator(
+                    "//span[normalize-space()='Step approved successfully']"
+                ).wait_for(state="visible", timeout=30000)
+
+                plan_id = BasePage.get_first_plan_id(self)
+                BasePage.approve_plan_by_id(self, plan_id)
+
+        expect(self.page.locator(self.COMPLETED_TASK)).to_contain_text("completed")
\ No newline at end of file
diff --git a/tests/e2e-test/pages/loginPage.py b/tests/e2e-test/pages/loginPage.py
index 0b4125566..a54e61354 100644
--- a/tests/e2e-test/pages/loginPage.py
+++ b/tests/e2e-test/pages/loginPage.py
@@ -1,7 +1,10 @@
+"""Login Page module for handling authentication via email and password."""
+
 from base.base import BasePage
 
 
 class LoginPage(BasePage):
+    """Page object model for login and Microsoft authentication flow."""
 
     EMAIL_TEXT_BOX = "//input[@type='email']"
     NEXT_BUTTON = "//input[@type='submit']"
@@ -11,26 +14,24 @@ class LoginPage(BasePage):
     PERMISSION_ACCEPT_BUTTON = "//input[@type='submit']"
 
     def __init__(self, page):
+        """Initialize the LoginPage with the Playwright page instance."""
         self.page = page
 
     def authenticate(self, username, password):
-        # login with username and password in web url
+        """Login using provided username and password with conditional prompts."""
         self.page.locator(self.EMAIL_TEXT_BOX).fill(username)
         self.page.locator(self.NEXT_BUTTON).click()
-        # Wait for the password input field to be available and fill it
         self.page.wait_for_load_state("networkidle")
-        # Enter password
+
         self.page.locator(self.PASSWORD_TEXT_BOX).fill(password)
-        # Click on SignIn button
         self.page.locator(self.SIGNIN_BUTTON).click()
-        # Wait for 5 seconds to ensure the login process completes
         self.page.wait_for_timeout(20000)  # Wait for 20 seconds
+
         if self.page.locator(self.PERMISSION_ACCEPT_BUTTON).is_visible():
             self.page.locator(self.PERMISSION_ACCEPT_BUTTON).click()
             self.page.wait_for_timeout(10000)
         else:
-            # Click on YES button
             self.page.locator(self.YES_BUTTON).click()
             self.page.wait_for_timeout(10000)
-        # Wait for the "Articles" button to be available and click it
-        self.page.wait_for_load_state("networkidle")
+
+        self.page.wait_for_load_state("networkidle")
\ No newline at end of file
diff --git a/tests/e2e-test/tests/conftest.py b/tests/e2e-test/tests/conftest.py
index 92e34ccaa..87a0f7474 100644
--- a/tests/e2e-test/tests/conftest.py
+++ b/tests/e2e-test/tests/conftest.py
@@ -1,52 +1,112 @@
+"""Configuration and shared fixtures for pytest automation test suite."""
+
+import atexit
+import io
+import logging
 import os
 
 import pytest
-from config.constants import URL
+from bs4 import BeautifulSoup
 from playwright.sync_api import sync_playwright
-from py.xml import html  # type: ignore
+
+from config.constants import URL  # Explicit import instead of wildcard
+
+# Uncomment if login is to be used
+# from pages.loginPage import LoginPage
 
 
 @pytest.fixture(scope="session")
 def login_logout():
-    # perform login and browser close once in a session
+    """Perform login once per session and yield a Playwright page instance."""
     with sync_playwright() as p:
         browser = p.chromium.launch(headless=False, args=["--start-maximized"])
         context = browser.new_context(no_viewport=True)
         context.set_default_timeout(120000)
         page = context.new_page()
-        # Navigate to the login URL
         page.goto(URL)
-        # Wait for the login form to appear
         page.wait_for_load_state("networkidle")
 
-        yield page
+        # Uncomment below to perform actual login
+        # login_page = LoginPage(page)
+        # load_dotenv()
+        # login_page.authenticate(os.getenv('user_name'), os.getenv('pass_word'))
 
-        # perform close the browser
+        yield page
         browser.close()
 
 
 @pytest.hookimpl(tryfirst=True)
 def pytest_html_report_title(report):
-    report.title = "Automation_MACAE"
+    """Customize HTML report title."""
+    report.title = "Test Automation MACAE"
 
 
-# Add a column for descriptions
-def pytest_html_results_table_header(cells):
-    cells.insert(1, html.th("Description"))
+log_streams = {}
 
 
-def pytest_html_results_table_row(report, cells):
-    cells.insert(
-        1, html.td(report.description if hasattr(report, "description") else "")
-    )
+@pytest.hookimpl(tryfirst=True)
+def pytest_runtest_setup(item):
+    """Attach a log stream to each test for capturing stdout/stderr."""
+    stream = io.StringIO()
+    handler = logging.StreamHandler(stream)
+    handler.setLevel(logging.INFO)
+
+    logger = logging.getLogger()
+    logger.addHandler(handler)
+
+    log_streams[item.nodeid] = (handler, stream)
 
 
-# Add logs and docstring to report
 @pytest.hookimpl(hookwrapper=True)
 def pytest_runtest_makereport(item, call):
+    """Inject captured logs into HTML report for each test."""
     outcome = yield
     report = outcome.get_result()
-    report.description = str(item.function.__doc__)
-    os.makedirs("logs", exist_ok=True)
-    extra = getattr(report, "extra", [])
-    report.extra = extra
+
+    handler, stream = log_streams.get(item.nodeid, (None, None))
+
+    if handler and stream:
+        handler.flush()
+        log_output = stream.getvalue()
+        logger = logging.getLogger()
+        logger.removeHandler(handler)
+
+        report.description = f"<pre>{log_output.strip()}</pre>"
+        log_streams.pop(item.nodeid, None)
+    else:
+        report.description = ""
+
+
+def pytest_collection_modifyitems(items):
+    """Rename test node IDs in HTML report based on parametrized prompts."""
+    for item in items:
+        if hasattr(item, "callspec"):
+            prompt = item.callspec.params.get("prompt")
+            if prompt:
+                item._nodeid = prompt
+
+
+def rename_duration_column():
+    """Post-process HTML report to rename 'Duration' column to 'Execution Time'."""
+    report_path = os.path.abspath("report.html")
+    if not os.path.exists(report_path):
+        print("Report file not found, skipping column rename.")
+        return
+
+    with open(report_path, "r", encoding="utf-8") as f:
+        soup = BeautifulSoup(f, "html.parser")
+
+    headers = soup.select("table#results-table thead th")
+    for th in headers:
+        if th.text.strip() == "Duration":
+            th.string = "Execution Time"
+            break
+    else:
+        print("'Duration' column not found in report.")
+
+    with open(report_path, "w", encoding="utf-8") as f:
+        f.write(str(soup))
+
+
+# Register the report modification function to run after tests
+atexit.register(rename_duration_column)
\ No newline at end of file
diff --git a/tests/e2e-test/tests/test_MACAE_GP.py b/tests/e2e-test/tests/test_MACAE_GP.py
new file mode 100644
index 000000000..3eca241dc
--- /dev/null
+++ b/tests/e2e-test/tests/test_MACAE_GP.py
@@ -0,0 +1,87 @@
+"""GP Test cases for MACAE."""
+
+import logging
+import time
+
+import pytest
+
+from config.constants import (employee_details, product_details,
+                              prompt_question1, prompt_question2, rai_prompt)
+from pages.BIAB import BIABPage
+
+logger = logging.getLogger(__name__)
+
+
+# Define test steps and prompts
+test_cases = [
+    ("Validate home page is loaded", lambda biab: biab.validate_home_page()),
+    (
+        f"Verify Run Prompt 1: '{prompt_question1}' & run all stages",
+        lambda biab: (
+            biab.enter_a_question(prompt_question1),
+            biab.click_send_button(),
+            # biab.click_my_task(),
+            biab.enter_aditional_info(employee_details),
+            # biab.click_aditional_send_button(),
+            biab.processing_different_stage(),
+        ),
+    ),
+    (
+        f"Verify Run Prompt 2: '{prompt_question2}' & run all stages",
+        lambda biab: (
+            biab.click_new_task(),
+            biab.enter_a_question(prompt_question2),
+            biab.click_send_button(),
+            # biab.click_my_task(),
+            biab.enter_aditional_info(product_details),
+            # biab.click_aditional_send_button(),
+            biab.processing_different_stage(),
+        ),
+    ),
+    (
+        "Verify Run Prompt 3 via Quick Task - Mobile Plan Query & run all stages",
+        lambda biab: (
+            biab.click_new_task(),
+            biab.click_mobile_plan(),
+            biab.click_send_button(),
+            # biab.click_my_task(),
+            biab.processing_different_stage(),
+        ),
+    ),
+    (
+        f"Verify Run RAI Prompt: '{rai_prompt}' to make sure task is not created and validation message is displayed.",
+        lambda biab: (
+            biab.click_new_task(),
+            biab.enter_a_question(rai_prompt),
+            biab.validate_rai_validation_message(),
+        ),
+    ),
+]
+
+# Create test IDs like "01. Validate home page", "02. Run Prompt 1: ..."
+test_ids = [f"{i + 1:02d}. {case[0]}" for i, case in enumerate(test_cases)]
+
+
+@pytest.mark.parametrize("prompt, action", test_cases, ids=test_ids)
+def test_biab_prompt_case(login_logout, prompt, action, request):
+    """Each BIAB prompt runs as an individual test case with execution time logging and meaningful test step titles."""
+    page = login_logout
+    biab_page = BIABPage(page)
+    logger.info(f"Running test step: {prompt}")
+
+    start = time.time()
+    if isinstance(action, tuple):
+        for step in action:
+            if callable(step):
+                step()
+    else:
+        action(biab_page)
+    end = time.time()
+
+    duration = end - start
+    logger.info(f"Execution Time for '{prompt}': {duration:.2f}s")
+
+    # Attach execution time to pytest report
+    request.node._report_sections.append(
+        ("call", "log", f"Execution time: {duration:.2f}s")
+    )
\ No newline at end of file

From c9a59ab45147d37baa945460d6f3941dc12e9d89 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Thu, 10 Jul 2025 10:36:18 +0530
Subject: [PATCH 45/70] updated requirements.txt

---
 tests/e2e-test/requirements.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/e2e-test/requirements.txt b/tests/e2e-test/requirements.txt
index 1b0ac0d7c..4e488e559 100644
--- a/tests/e2e-test/requirements.txt
+++ b/tests/e2e-test/requirements.txt
@@ -4,3 +4,4 @@ python-dotenv
 pytest-check
 pytest-html
 py
+beautifulsoup4
\ No newline at end of file

From 8da81e513106fe9500a710bbf6373b7bf3c9fddb Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Thu, 10 Jul 2025 11:42:06 +0530
Subject: [PATCH 46/70] edit

---
 tests/e2e-test/tests/test_poc_BIAB.py | 41 ---------------------------
 1 file changed, 41 deletions(-)
 delete mode 100644 tests/e2e-test/tests/test_poc_BIAB.py

diff --git a/tests/e2e-test/tests/test_poc_BIAB.py b/tests/e2e-test/tests/test_poc_BIAB.py
deleted file mode 100644
index b382146ad..000000000
--- a/tests/e2e-test/tests/test_poc_BIAB.py
+++ /dev/null
@@ -1,41 +0,0 @@
-import logging
-
-from config.constants import prompt_question1, prompt_question2, rai_prompt, employee_details, product_details
-from pages.BIAB import BIABPage
-
-logger = logging.getLogger(__name__)
-
-
-def test_biab_PAGE_AUTOMATION(login_logout):
-    """Validate Golden path test case for Multi-Agent-Custom-Automation-Engine"""
-    page = login_logout
-    biab_page = BIABPage(page)
-    logger.info("Step 1: Validate home page is loaded.")
-    biab_page.validate_home_page()
-    logger.info("Step 2: Validate Run Sample prompt1 & run plans")
-    biab_page.enter_a_question(prompt_question1)
-    biab_page.click_send_button()
-    biab_page.click_my_task()
-    biab_page.enter_aditional_info(employee_details)
-    # biab_page.click_aditional_send_button()
-    biab_page.processing_different_stage()
-    biab_page.click_new_task()
-    logger.info("Step 3: Validate Run Sample prompt2 & run plans")
-    biab_page.enter_a_question(prompt_question2)
-    biab_page.click_send_button()
-    biab_page.click_my_task()
-    biab_page.enter_aditional_info(product_details)
-    # biab_page.click_aditional_send_button()
-    biab_page.processing_different_stage()
-    biab_page.click_new_task()
-    logger.info("Step 4: Validate Run Sample prompt3 from Quick Tasks & run plans")
-    biab_page.click_mobile_plan()
-    biab_page.click_send_button()
-    biab_page.click_my_task()
-    biab_page.processing_different_stage()
-    biab_page.click_new_task()
-    logger.info(
-        "Step 5: Validate Run known RAI test prompts to ensure that you get the toast saying that a plan cannot be generated"
-    )
-    biab_page.enter_a_question(rai_prompt)
-    biab_page.validate_rai_validation_message()

From a12740e4615095bcf35c4e5a70d1fdf9d5956c1a Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Thu, 10 Jul 2025 15:52:47 +0530
Subject: [PATCH 47/70] edit

---
 .github/workflows/test-automation.yml | 8 ++++----
 tests/e2e-test/pages/BIAB.py          | 1 +
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index 8698bbe28..7ed7df8b7 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -172,16 +172,16 @@ jobs:
                     "body": "<p>Dear Team,</p><p>We would like to inform you that the ${{ env.accelerator_name }} Test Automation process has completed successfully.</p><p><strong>Run URL:</strong> <a href=\\"${RUN_URL}\\">${RUN_URL}</a><br></p><p><strong>Test Report:</strong> <a href=\\"${REPORT_URL}\\">${REPORT_URL}</a></p><p>Best regards,<br>Your Automation Team</p>",
                     "subject": "${{ env.accelerator_name }} Test Automation - Success"
                   }
-                  EOF
-                  )
+          EOF
+            )
           else
                   EMAIL_BODY=$(cat <<EOF
                   {
                     "body": "<p>Dear Team,</p><p>We would like to inform you that the ${{ env.accelerator_name }} Test Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Run URL:</strong> <a href=\\"${RUN_URL}\\">${RUN_URL}</a><br></p><p><strong>Test Report:</strong> <a href=\\"${REPORT_URL}\\">${REPORT_URL}</a></p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>",
                     "subject": "${{ env.accelerator_name }} Test Automation - Failure"
                   }
-                  EOF
-                  )
+          EOF
+            )
           fi
 
           curl -X POST "${{ secrets.EMAILNOTIFICATION_LOGICAPP_URL_TA }}" \
diff --git a/tests/e2e-test/pages/BIAB.py b/tests/e2e-test/pages/BIAB.py
index 4b4c99795..e2352c5a9 100644
--- a/tests/e2e-test/pages/BIAB.py
+++ b/tests/e2e-test/pages/BIAB.py
@@ -103,5 +103,6 @@ def processing_different_stage(self):
 
                 plan_id = BasePage.get_first_plan_id(self)
                 BasePage.approve_plan_by_id(self, plan_id)
+                self.page.wait_for_timeout(7000)
 
         expect(self.page.locator(self.COMPLETED_TASK)).to_contain_text("completed")
\ No newline at end of file

From a675c617f0c0941b12853e6b1aec21e2bc99eeff Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Thu, 10 Jul 2025 16:41:40 +0530
Subject: [PATCH 48/70] commented cleanup deployment

---
 .github/workflows/deploy.yml | 319 +++++++++++++++++------------------
 1 file changed, 158 insertions(+), 161 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 3d5a870a6..426515a70 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -23,7 +23,7 @@ jobs:
       RESOURCE_GROUP_NAME: ${{ steps.check_create_rg.outputs.RESOURCE_GROUP_NAME }}
       WEBAPP_URL: ${{ steps.get_output.outputs.WEBAPP_URL }}
       DEPLOYMENT_SUCCESS: ${{ steps.deployment_status.outputs.SUCCESS }}
-      API_APP_URL: ${{ steps.get_backend_url.outputs.CONTAINER_APP_URL }} 
+      API_APP_URL: ${{ steps.get_backend_url.outputs.CONTAINER_APP_URL }}
       CONTAINER_APP: ${{steps.get_backend_url.outputs.CONTAINER_APP}}
     steps:
       - name: Checkout Code
@@ -162,7 +162,6 @@ jobs:
           echo "CONTAINER_APP_URL=https://${CONTAINER_APP_URL}" >> $GITHUB_OUTPUT
           echo "CONTAINER_APP=${CONTAINER_APP_NAME}" >> $GITHUB_OUTPUT
 
-
       - name: Set Deployment Status
         id: deployment_status
         if: always()
@@ -184,162 +183,160 @@ jobs:
       MACAE_CONTAINER_APP: ${{ needs.deploy.outputs.CONTAINER_APP }}
     secrets: inherit
 
-  cleanup-deployment:
-    if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
-    needs: [deploy, e2e-test]
-    runs-on: ubuntu-latest
-    env:
-      RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
-    steps:
-      - name: Setup Azure CLI
-        run: |
-          curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
-          az --version
-      - name: Login to Azure
-        run: |
-          az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
-          az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
-
-      - name: Extract AI Services and Key Vault Names
-        if: always()
-        run: |
-          echo "Fetching AI Services and Key Vault names before deletion..."
-
-          # Get Key Vault name
-          KEYVAULT_NAME=$(az resource list --resource-group "${{ env.RESOURCE_GROUP_NAME }}" --resource-type "Microsoft.KeyVault/vaults" --query "[].name" -o tsv)
-          echo "Detected Key Vault: $KEYVAULT_NAME"
-          echo "KEYVAULT_NAME=$KEYVAULT_NAME" >> $GITHUB_ENV
-          # Extract AI Services names
-          echo "Fetching AI Services..."
-          AI_SERVICES=$(az resource list --resource-group '${{ env.RESOURCE_GROUP_NAME }}' --resource-type "Microsoft.CognitiveServices/accounts" --query "[].name" -o tsv)
-          # Flatten newline-separated values to space-separated
-          AI_SERVICES=$(echo "$AI_SERVICES" | paste -sd ' ' -)
-          echo "Detected AI Services: $AI_SERVICES"
-          echo "AI_SERVICES=$AI_SERVICES" >> $GITHUB_ENV
-
-      - name: Get OpenAI Resource from Resource Group
-        id: get_openai_resource
-        run: |
-
-
-          set -e
-          echo "Fetching OpenAI resource from resource group ${{ env.RESOURCE_GROUP_NAME }}..."
-
-          # Run the az resource list command to get the OpenAI resource name
-          openai_resource_name=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.CognitiveServices/accounts" --query "[0].name" -o tsv)
-
-          if [ -z "$openai_resource_name" ]; then
-            echo "No OpenAI resource found in resource group ${{ env.RESOURCE_GROUP_NAME }}."
-            exit 1
-          else
-            echo "OPENAI_RESOURCE_NAME=${openai_resource_name}" >> $GITHUB_ENV
-            echo "OpenAI resource name: ${openai_resource_name}" 
-          fi
-
-      - name: Delete Bicep Deployment
-        if: always()
-        run: |
-          set -e  
-          echo "Checking if resource group exists..."
-          rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
-          if [ "$rg_exists" = "true" ]; then
-            echo "Resource group exist. Cleaning..."
-            az group delete \
-                --name ${{ env.RESOURCE_GROUP_NAME }} \
-                --yes \
-                --no-wait
-            echo "Resource group deleted...  ${{ env.RESOURCE_GROUP_NAME }}"
-          else
-            echo "Resource group does not exists."
-          fi
-
-      - name: Wait for resource deletion to complete
-        run: |
-
-
-          # Add resources to the array
-          resources_to_check=("${{ env.OPENAI_RESOURCE_NAME }}")
-
-          echo "List of resources to check: ${resources_to_check[@]}"
-
-          # Maximum number of retries
-          max_retries=3
-
-          # Retry intervals in seconds (30, 60, 120)
-          retry_intervals=(30 60 120)
-
-          # Retry mechanism to check resources
-          retries=0
-          while true; do
-            resource_found=false
-
-            # Get the list of resources in YAML format again on each retry
-            resource_list=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --output yaml)
-
-            # Iterate through the resources to check
-            for resource in "${resources_to_check[@]}"; do
-              echo "Checking resource: $resource"
-              if echo "$resource_list" | grep -q "name: $resource"; then
-                echo "Resource '$resource' exists in the resource group."
-                resource_found=true
-              else
-                echo "Resource '$resource' does not exist in the resource group."
-              fi
-            done
-
-            # If any resource exists, retry
-            if [ "$resource_found" = true ]; then
-              retries=$((retries + 1))
-              if [ "$retries" -gt "$max_retries" ]; then
-                echo "Maximum retry attempts reached. Exiting."
-                break
-              else
-                # Wait for the appropriate interval for the current retry
-                echo "Waiting for ${retry_intervals[$retries-1]} seconds before retrying..."
-                sleep ${retry_intervals[$retries-1]}
-              fi
-            else
-              echo "No resources found. Exiting."
-              break
-            fi
-          done
-
-      - name: Purging the Resources
-        if: always()
-        run: |
-
-          set -e 
-          echo "Azure OpenAI: ${{ env.OPENAI_RESOURCE_NAME }}"
-
-          # Purge OpenAI Resource
-          echo "Purging the OpenAI Resource..."
-          if ! az resource delete --ids /subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/providers/Microsoft.CognitiveServices/locations/eastus/resourceGroups/${{ env.RESOURCE_GROUP_NAME }}/deletedAccounts/${{ env.OPENAI_RESOURCE_NAME }} --verbose; then
-            echo "Failed to purge openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
-          else
-            echo "Purged the openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
-          fi
-
-          echo "Resource purging completed successfully"
-
-      - name: Send Notification on Failure
-        if: failure()
-        run: |
-          RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-
-          # Construct the email body
-          EMAIL_BODY=$(cat <<EOF
-          {
-            "body": "<p>Dear Team,</p><p>We would like to inform you that the Multi-Agent-Custom-Automation-Engine-Solution-Accelerator Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Build URL:</strong> ${RUN_URL}<br> ${OUTPUT}</p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>"
-          }
-          EOF
-          )
-
-          # Send the notification
-          curl -X POST "${{ secrets.LOGIC_APP_URL }}" \
-            -H "Content-Type: application/json" \
-            -d "$EMAIL_BODY" || echo "Failed to send notification"
-      - name: Logout from Azure
-        if: always()
-        run: |
-          az logout
-          echo "Logged out from Azure."
+  # cleanup-deployment:
+  #   if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
+  #   needs: [deploy, e2e-test]
+  #   runs-on: ubuntu-latest
+  #   env:
+  #     RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
+  #   steps:
+  #     - name: Setup Azure CLI
+  #       run: |
+  #         curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
+  #         az --version
+  #     - name: Login to Azure
+  #       run: |
+  #         az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
+  #         az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
+
+  #     - name: Extract AI Services and Key Vault Names
+  #       if: always()
+  #       run: |
+  #         echo "Fetching AI Services and Key Vault names before deletion..."
+
+  #         # Get Key Vault name
+  #         KEYVAULT_NAME=$(az resource list --resource-group "${{ env.RESOURCE_GROUP_NAME }}" --resource-type "Microsoft.KeyVault/vaults" --query "[].name" -o tsv)
+  #         echo "Detected Key Vault: $KEYVAULT_NAME"
+  #         echo "KEYVAULT_NAME=$KEYVAULT_NAME" >> $GITHUB_ENV
+  #         # Extract AI Services names
+  #         echo "Fetching AI Services..."
+  #         AI_SERVICES=$(az resource list --resource-group '${{ env.RESOURCE_GROUP_NAME }}' --resource-type "Microsoft.CognitiveServices/accounts" --query "[].name" -o tsv)
+  #         # Flatten newline-separated values to space-separated
+  #         AI_SERVICES=$(echo "$AI_SERVICES" | paste -sd ' ' -)
+  #         echo "Detected AI Services: $AI_SERVICES"
+  #         echo "AI_SERVICES=$AI_SERVICES" >> $GITHUB_ENV
+
+  #     - name: Get OpenAI Resource from Resource Group
+  #       id: get_openai_resource
+  #       run: |
+
+  #         set -e
+  #         echo "Fetching OpenAI resource from resource group ${{ env.RESOURCE_GROUP_NAME }}..."
+
+  #         # Run the az resource list command to get the OpenAI resource name
+  #         openai_resource_name=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.CognitiveServices/accounts" --query "[0].name" -o tsv)
+
+  #         if [ -z "$openai_resource_name" ]; then
+  #           echo "No OpenAI resource found in resource group ${{ env.RESOURCE_GROUP_NAME }}."
+  #           exit 1
+  #         else
+  #           echo "OPENAI_RESOURCE_NAME=${openai_resource_name}" >> $GITHUB_ENV
+  #           echo "OpenAI resource name: ${openai_resource_name}"
+  #         fi
+
+  #     - name: Delete Bicep Deployment
+  #       if: always()
+  #       run: |
+  #         set -e
+  #         echo "Checking if resource group exists..."
+  #         rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
+  #         if [ "$rg_exists" = "true" ]; then
+  #           echo "Resource group exist. Cleaning..."
+  #           az group delete \
+  #               --name ${{ env.RESOURCE_GROUP_NAME }} \
+  #               --yes \
+  #               --no-wait
+  #           echo "Resource group deleted...  ${{ env.RESOURCE_GROUP_NAME }}"
+  #         else
+  #           echo "Resource group does not exists."
+  #         fi
+
+  #     - name: Wait for resource deletion to complete
+  #       run: |
+
+  #         # Add resources to the array
+  #         resources_to_check=("${{ env.OPENAI_RESOURCE_NAME }}")
+
+  #         echo "List of resources to check: ${resources_to_check[@]}"
+
+  #         # Maximum number of retries
+  #         max_retries=3
+
+  #         # Retry intervals in seconds (30, 60, 120)
+  #         retry_intervals=(30 60 120)
+
+  #         # Retry mechanism to check resources
+  #         retries=0
+  #         while true; do
+  #           resource_found=false
+
+  #           # Get the list of resources in YAML format again on each retry
+  #           resource_list=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --output yaml)
+
+  #           # Iterate through the resources to check
+  #           for resource in "${resources_to_check[@]}"; do
+  #             echo "Checking resource: $resource"
+  #             if echo "$resource_list" | grep -q "name: $resource"; then
+  #               echo "Resource '$resource' exists in the resource group."
+  #               resource_found=true
+  #             else
+  #               echo "Resource '$resource' does not exist in the resource group."
+  #             fi
+  #           done
+
+  #           # If any resource exists, retry
+  #           if [ "$resource_found" = true ]; then
+  #             retries=$((retries + 1))
+  #             if [ "$retries" -gt "$max_retries" ]; then
+  #               echo "Maximum retry attempts reached. Exiting."
+  #               break
+  #             else
+  #               # Wait for the appropriate interval for the current retry
+  #               echo "Waiting for ${retry_intervals[$retries-1]} seconds before retrying..."
+  #               sleep ${retry_intervals[$retries-1]}
+  #             fi
+  #           else
+  #             echo "No resources found. Exiting."
+  #             break
+  #           fi
+  #         done
+
+  #     - name: Purging the Resources
+  #       if: always()
+  #       run: |
+
+  #         set -e
+  #         echo "Azure OpenAI: ${{ env.OPENAI_RESOURCE_NAME }}"
+
+  #         # Purge OpenAI Resource
+  #         echo "Purging the OpenAI Resource..."
+  #         if ! az resource delete --ids /subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/providers/Microsoft.CognitiveServices/locations/eastus/resourceGroups/${{ env.RESOURCE_GROUP_NAME }}/deletedAccounts/${{ env.OPENAI_RESOURCE_NAME }} --verbose; then
+  #           echo "Failed to purge openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
+  #         else
+  #           echo "Purged the openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
+  #         fi
+
+  #         echo "Resource purging completed successfully"
+
+  #     - name: Send Notification on Failure
+  #       if: failure()
+  #       run: |
+  #         RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
+  #         # Construct the email body
+  #         EMAIL_BODY=$(cat <<EOF
+  #         {
+  #           "body": "<p>Dear Team,</p><p>We would like to inform you that the Multi-Agent-Custom-Automation-Engine-Solution-Accelerator Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Build URL:</strong> ${RUN_URL}<br> ${OUTPUT}</p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>"
+  #         }
+  #         EOF
+  #         )
+
+  #         # Send the notification
+  #         curl -X POST "${{ secrets.LOGIC_APP_URL }}" \
+  #           -H "Content-Type: application/json" \
+  #           -d "$EMAIL_BODY" || echo "Failed to send notification"
+  #     - name: Logout from Azure
+  #       if: always()
+  #       run: |
+  #         az logout
+  #         echo "Logged out from Azure."

From 84d0d4328cf31ef17dca9ac011f8328c3c35dead Mon Sep 17 00:00:00 2001
From: Harmanpreet-Microsoft <v-harmanprka@microsoft.com>
Date: Thu, 10 Jul 2025 17:21:49 +0530
Subject: [PATCH 49/70] Update deploy.yml

---
 .github/workflows/deploy.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 426515a70..040f02f58 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -23,7 +23,7 @@ jobs:
       RESOURCE_GROUP_NAME: ${{ steps.check_create_rg.outputs.RESOURCE_GROUP_NAME }}
       WEBAPP_URL: ${{ steps.get_output.outputs.WEBAPP_URL }}
       DEPLOYMENT_SUCCESS: ${{ steps.deployment_status.outputs.SUCCESS }}
-      API_APP_URL: ${{ steps.get_backend_url.outputs.CONTAINER_APP_URL }}
+      MACAE_URL_API: ${{ steps.get_backend_url.outputs.MACAE_URL_API }}
       CONTAINER_APP: ${{steps.get_backend_url.outputs.CONTAINER_APP}}
     steps:
       - name: Checkout Code
@@ -154,12 +154,12 @@ jobs:
             --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
             --query "[0].name" -o tsv)
 
-          CONTAINER_APP_URL=$(az containerapp show \
+          MACAE_URL_API=$(az containerapp show \
             --name "$CONTAINER_APP_NAME" \
             --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
             --query "properties.configuration.ingress.fqdn" -o tsv)
 
-          echo "CONTAINER_APP_URL=https://${CONTAINER_APP_URL}" >> $GITHUB_OUTPUT
+          echo "MACAE_URL_API=https://${MACAE_URL_API}" >> $GITHUB_OUTPUT
           echo "CONTAINER_APP=${CONTAINER_APP_NAME}" >> $GITHUB_OUTPUT
 
       - name: Set Deployment Status
@@ -178,7 +178,7 @@ jobs:
     uses: ./.github/workflows/test-automation.yml
     with:
       MACAE_WEB_URL: ${{ needs.deploy.outputs.WEBAPP_URL }}
-      MACAE_URL_API: ${{ needs.deploy.outputs.API_APP_URL }}
+      MACAE_URL_API: ${{ needs.deploy.outputs.MACAE_URL_API }}
       MACAE_RG: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
       MACAE_CONTAINER_APP: ${{ needs.deploy.outputs.CONTAINER_APP }}
     secrets: inherit

From 5bc07d36cb269e1591eca5ff20e9c28f58422b74 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Thu, 10 Jul 2025 19:48:09 +0530
Subject: [PATCH 50/70] update

---
 tests/e2e-test/base/base.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/e2e-test/base/base.py b/tests/e2e-test/base/base.py
index 333a04e98..6e5a2e5e7 100644
--- a/tests/e2e-test/base/base.py
+++ b/tests/e2e-test/base/base.py
@@ -25,7 +25,7 @@ def is_visible(self, locator):
     def get_first_plan_id(self):
         """Step 1: Get plan list and return the first plan ID."""
         load_dotenv()
-        base_url = os.getenv("API_URL")
+        base_url = os.getenv("MACAE_URL_API")
         get_url = f"{base_url}/api/plans"
         headers = {
             "Accept": "*/*",
@@ -49,7 +49,7 @@ def get_first_plan_id(self):
 
     def approve_plan_by_id(self, plan_id: str):
         """Step 2: Approve plan using the given plan ID."""
-        base_url = os.getenv("API_URL")
+        base_url = os.getenv("MACAE_URL_API")
         approve_url = f"{base_url}/api/plans?plan_id={plan_id}"
         headers = {
             "Accept": "*/*",

From 134e1479ba49b895f837cff97e64ae3b0b16b1bc Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Thu, 10 Jul 2025 21:03:03 +0530
Subject: [PATCH 51/70] uncommented cleanup deployment

---
 .github/workflows/deploy.yml          | 314 +++++++++---------
 .github/workflows/test-automation.yml | 446 +++++++++++++++++---------
 2 files changed, 452 insertions(+), 308 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 040f02f58..e11a29790 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -183,160 +183,160 @@ jobs:
       MACAE_CONTAINER_APP: ${{ needs.deploy.outputs.CONTAINER_APP }}
     secrets: inherit
 
-  # cleanup-deployment:
-  #   if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
-  #   needs: [deploy, e2e-test]
-  #   runs-on: ubuntu-latest
-  #   env:
-  #     RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
-  #   steps:
-  #     - name: Setup Azure CLI
-  #       run: |
-  #         curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
-  #         az --version
-  #     - name: Login to Azure
-  #       run: |
-  #         az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
-  #         az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
-
-  #     - name: Extract AI Services and Key Vault Names
-  #       if: always()
-  #       run: |
-  #         echo "Fetching AI Services and Key Vault names before deletion..."
-
-  #         # Get Key Vault name
-  #         KEYVAULT_NAME=$(az resource list --resource-group "${{ env.RESOURCE_GROUP_NAME }}" --resource-type "Microsoft.KeyVault/vaults" --query "[].name" -o tsv)
-  #         echo "Detected Key Vault: $KEYVAULT_NAME"
-  #         echo "KEYVAULT_NAME=$KEYVAULT_NAME" >> $GITHUB_ENV
-  #         # Extract AI Services names
-  #         echo "Fetching AI Services..."
-  #         AI_SERVICES=$(az resource list --resource-group '${{ env.RESOURCE_GROUP_NAME }}' --resource-type "Microsoft.CognitiveServices/accounts" --query "[].name" -o tsv)
-  #         # Flatten newline-separated values to space-separated
-  #         AI_SERVICES=$(echo "$AI_SERVICES" | paste -sd ' ' -)
-  #         echo "Detected AI Services: $AI_SERVICES"
-  #         echo "AI_SERVICES=$AI_SERVICES" >> $GITHUB_ENV
-
-  #     - name: Get OpenAI Resource from Resource Group
-  #       id: get_openai_resource
-  #       run: |
-
-  #         set -e
-  #         echo "Fetching OpenAI resource from resource group ${{ env.RESOURCE_GROUP_NAME }}..."
-
-  #         # Run the az resource list command to get the OpenAI resource name
-  #         openai_resource_name=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.CognitiveServices/accounts" --query "[0].name" -o tsv)
-
-  #         if [ -z "$openai_resource_name" ]; then
-  #           echo "No OpenAI resource found in resource group ${{ env.RESOURCE_GROUP_NAME }}."
-  #           exit 1
-  #         else
-  #           echo "OPENAI_RESOURCE_NAME=${openai_resource_name}" >> $GITHUB_ENV
-  #           echo "OpenAI resource name: ${openai_resource_name}"
-  #         fi
-
-  #     - name: Delete Bicep Deployment
-  #       if: always()
-  #       run: |
-  #         set -e
-  #         echo "Checking if resource group exists..."
-  #         rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
-  #         if [ "$rg_exists" = "true" ]; then
-  #           echo "Resource group exist. Cleaning..."
-  #           az group delete \
-  #               --name ${{ env.RESOURCE_GROUP_NAME }} \
-  #               --yes \
-  #               --no-wait
-  #           echo "Resource group deleted...  ${{ env.RESOURCE_GROUP_NAME }}"
-  #         else
-  #           echo "Resource group does not exists."
-  #         fi
-
-  #     - name: Wait for resource deletion to complete
-  #       run: |
-
-  #         # Add resources to the array
-  #         resources_to_check=("${{ env.OPENAI_RESOURCE_NAME }}")
-
-  #         echo "List of resources to check: ${resources_to_check[@]}"
-
-  #         # Maximum number of retries
-  #         max_retries=3
-
-  #         # Retry intervals in seconds (30, 60, 120)
-  #         retry_intervals=(30 60 120)
-
-  #         # Retry mechanism to check resources
-  #         retries=0
-  #         while true; do
-  #           resource_found=false
-
-  #           # Get the list of resources in YAML format again on each retry
-  #           resource_list=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --output yaml)
-
-  #           # Iterate through the resources to check
-  #           for resource in "${resources_to_check[@]}"; do
-  #             echo "Checking resource: $resource"
-  #             if echo "$resource_list" | grep -q "name: $resource"; then
-  #               echo "Resource '$resource' exists in the resource group."
-  #               resource_found=true
-  #             else
-  #               echo "Resource '$resource' does not exist in the resource group."
-  #             fi
-  #           done
-
-  #           # If any resource exists, retry
-  #           if [ "$resource_found" = true ]; then
-  #             retries=$((retries + 1))
-  #             if [ "$retries" -gt "$max_retries" ]; then
-  #               echo "Maximum retry attempts reached. Exiting."
-  #               break
-  #             else
-  #               # Wait for the appropriate interval for the current retry
-  #               echo "Waiting for ${retry_intervals[$retries-1]} seconds before retrying..."
-  #               sleep ${retry_intervals[$retries-1]}
-  #             fi
-  #           else
-  #             echo "No resources found. Exiting."
-  #             break
-  #           fi
-  #         done
-
-  #     - name: Purging the Resources
-  #       if: always()
-  #       run: |
-
-  #         set -e
-  #         echo "Azure OpenAI: ${{ env.OPENAI_RESOURCE_NAME }}"
-
-  #         # Purge OpenAI Resource
-  #         echo "Purging the OpenAI Resource..."
-  #         if ! az resource delete --ids /subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/providers/Microsoft.CognitiveServices/locations/eastus/resourceGroups/${{ env.RESOURCE_GROUP_NAME }}/deletedAccounts/${{ env.OPENAI_RESOURCE_NAME }} --verbose; then
-  #           echo "Failed to purge openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
-  #         else
-  #           echo "Purged the openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
-  #         fi
-
-  #         echo "Resource purging completed successfully"
-
-  #     - name: Send Notification on Failure
-  #       if: failure()
-  #       run: |
-  #         RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-
-  #         # Construct the email body
-  #         EMAIL_BODY=$(cat <<EOF
-  #         {
-  #           "body": "<p>Dear Team,</p><p>We would like to inform you that the Multi-Agent-Custom-Automation-Engine-Solution-Accelerator Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Build URL:</strong> ${RUN_URL}<br> ${OUTPUT}</p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>"
-  #         }
-  #         EOF
-  #         )
-
-  #         # Send the notification
-  #         curl -X POST "${{ secrets.LOGIC_APP_URL }}" \
-  #           -H "Content-Type: application/json" \
-  #           -d "$EMAIL_BODY" || echo "Failed to send notification"
-  #     - name: Logout from Azure
-  #       if: always()
-  #       run: |
-  #         az logout
-  #         echo "Logged out from Azure."
+  cleanup-deployment:
+    if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
+    needs: [deploy, e2e-test]
+    runs-on: ubuntu-latest
+    env:
+      RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
+    steps:
+      - name: Setup Azure CLI
+        run: |
+          curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
+          az --version
+      - name: Login to Azure
+        run: |
+          az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
+          az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
+
+      - name: Extract AI Services and Key Vault Names
+        if: always()
+        run: |
+          echo "Fetching AI Services and Key Vault names before deletion..."
+
+          # Get Key Vault name
+          KEYVAULT_NAME=$(az resource list --resource-group "${{ env.RESOURCE_GROUP_NAME }}" --resource-type "Microsoft.KeyVault/vaults" --query "[].name" -o tsv)
+          echo "Detected Key Vault: $KEYVAULT_NAME"
+          echo "KEYVAULT_NAME=$KEYVAULT_NAME" >> $GITHUB_ENV
+          # Extract AI Services names
+          echo "Fetching AI Services..."
+          AI_SERVICES=$(az resource list --resource-group '${{ env.RESOURCE_GROUP_NAME }}' --resource-type "Microsoft.CognitiveServices/accounts" --query "[].name" -o tsv)
+          # Flatten newline-separated values to space-separated
+          AI_SERVICES=$(echo "$AI_SERVICES" | paste -sd ' ' -)
+          echo "Detected AI Services: $AI_SERVICES"
+          echo "AI_SERVICES=$AI_SERVICES" >> $GITHUB_ENV
+
+      - name: Get OpenAI Resource from Resource Group
+        id: get_openai_resource
+        run: |
+
+          set -e
+          echo "Fetching OpenAI resource from resource group ${{ env.RESOURCE_GROUP_NAME }}..."
+
+          # Run the az resource list command to get the OpenAI resource name
+          openai_resource_name=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.CognitiveServices/accounts" --query "[0].name" -o tsv)
+
+          if [ -z "$openai_resource_name" ]; then
+            echo "No OpenAI resource found in resource group ${{ env.RESOURCE_GROUP_NAME }}."
+            exit 1
+          else
+            echo "OPENAI_RESOURCE_NAME=${openai_resource_name}" >> $GITHUB_ENV
+            echo "OpenAI resource name: ${openai_resource_name}"
+          fi
+
+      - name: Delete Bicep Deployment
+        if: always()
+        run: |
+          set -e
+          echo "Checking if resource group exists..."
+          rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
+          if [ "$rg_exists" = "true" ]; then
+            echo "Resource group exist. Cleaning..."
+            az group delete \
+                --name ${{ env.RESOURCE_GROUP_NAME }} \
+                --yes \
+                --no-wait
+            echo "Resource group deleted...  ${{ env.RESOURCE_GROUP_NAME }}"
+          else
+            echo "Resource group does not exists."
+          fi
+
+      - name: Wait for resource deletion to complete
+        run: |
+
+          # Add resources to the array
+          resources_to_check=("${{ env.OPENAI_RESOURCE_NAME }}")
+
+          echo "List of resources to check: ${resources_to_check[@]}"
+
+          # Maximum number of retries
+          max_retries=3
+
+          # Retry intervals in seconds (30, 60, 120)
+          retry_intervals=(30 60 120)
+
+          # Retry mechanism to check resources
+          retries=0
+          while true; do
+            resource_found=false
+
+            # Get the list of resources in YAML format again on each retry
+            resource_list=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --output yaml)
+
+            # Iterate through the resources to check
+            for resource in "${resources_to_check[@]}"; do
+              echo "Checking resource: $resource"
+              if echo "$resource_list" | grep -q "name: $resource"; then
+                echo "Resource '$resource' exists in the resource group."
+                resource_found=true
+              else
+                echo "Resource '$resource' does not exist in the resource group."
+              fi
+            done
+
+            # If any resource exists, retry
+            if [ "$resource_found" = true ]; then
+              retries=$((retries + 1))
+              if [ "$retries" -gt "$max_retries" ]; then
+                echo "Maximum retry attempts reached. Exiting."
+                break
+              else
+                # Wait for the appropriate interval for the current retry
+                echo "Waiting for ${retry_intervals[$retries-1]} seconds before retrying..."
+                sleep ${retry_intervals[$retries-1]}
+              fi
+            else
+              echo "No resources found. Exiting."
+              break
+            fi
+          done
+
+      - name: Purging the Resources
+        if: always()
+        run: |
+
+          set -e
+          echo "Azure OpenAI: ${{ env.OPENAI_RESOURCE_NAME }}"
+
+          # Purge OpenAI Resource
+          echo "Purging the OpenAI Resource..."
+          if ! az resource delete --ids /subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/providers/Microsoft.CognitiveServices/locations/eastus/resourceGroups/${{ env.RESOURCE_GROUP_NAME }}/deletedAccounts/${{ env.OPENAI_RESOURCE_NAME }} --verbose; then
+            echo "Failed to purge openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
+          else
+            echo "Purged the openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
+          fi
+
+          echo "Resource purging completed successfully"
+
+      - name: Send Notification on Failure
+        if: failure()
+        run: |
+          RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
+          # Construct the email body
+          EMAIL_BODY=$(cat <<EOF
+          {
+            "body": "<p>Dear Team,</p><p>We would like to inform you that the Multi-Agent-Custom-Automation-Engine-Solution-Accelerator Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Build URL:</strong> ${RUN_URL}<br> ${OUTPUT}</p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>"
+          }
+          EOF
+          )
+
+          # Send the notification
+          curl -X POST "${{ secrets.LOGIC_APP_URL }}" \
+            -H "Content-Type: application/json" \
+            -d "$EMAIL_BODY" || echo "Failed to send notification"
+      - name: Logout from Azure
+        if: always()
+        run: |
+          az logout
+          echo "Logged out from Azure."
diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index 7ed7df8b7..049935177 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -2,197 +2,341 @@ name: Test Automation MACAE
 
 on:
   push:
+  workflow_run:
+    workflows: ["Build Docker and Optional Push"]
+    types:
+      - completed
     branches:
       - main
-      - dev
       - hotfix
-    paths:
-      - "tests/e2e-test/**"
   schedule:
-    - cron: "0 13 * * *"
-  workflow_dispatch:
-  workflow_call:
-    inputs:
-      MACAE_WEB_URL:
-        required: false
-        type: string
-        description: "Web URL for MACAE (overrides environment variable)"
-      MACAE_URL_API:
-        required: false
-        type: string
-        description: "API URL for MACAE (overrides environment variable)"
-      MACAE_RG:
-        required: false
-        type: string
-      MACAE_CONTAINER_APP:
-        required: false
-        type: string
-    secrets:
-      EMAILNOTIFICATION_LOGICAPP_URL_TA:
-        required: false
-        description: "Logic App URL for email notifications"
+    - cron: "0 11,23 * * *" # Runs at 11:00 AM and 11:00 PM GMT
+  workflow_dispatch: #Allow manual triggering
+env:
+  GPT_MIN_CAPACITY: 140
+  BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
 
 jobs:
-  test:
+  deploy:
     runs-on: ubuntu-latest
-    env:
-      MACAE_WEB_URL: ${{ inputs.MACAE_WEB_URL }}
-      MACAE_URL_API: ${{ inputs.MACAE_URL_API }}
-      MACAE_RG: ${{ inputs.MACAE_RG }}
-      MACAE_CONTAINER_APP: ${{ inputs.MACAE_CONTAINER_APP }}
-      accelerator_name: "MACAE"
-
+    outputs:
+      RESOURCE_GROUP_NAME: ${{ steps.check_create_rg.outputs.RESOURCE_GROUP_NAME }}
+      WEBAPP_URL: ${{ steps.get_output.outputs.WEBAPP_URL }}
+      DEPLOYMENT_SUCCESS: ${{ steps.deployment_status.outputs.SUCCESS }}
+      MACAE_URL_API: ${{ steps.get_backend_url.outputs.MACAE_URL_API }}
+      CONTAINER_APP: ${{steps.get_backend_url.outputs.CONTAINER_APP}}
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - name: Checkout Code
+        uses: actions/checkout@v3
+
+      - name: Run Quota Check
+        id: quota-check
+        run: |
+          export AZURE_CLIENT_ID=${{ secrets.AZURE_CLIENT_ID }}
+          export AZURE_TENANT_ID=${{ secrets.AZURE_TENANT_ID }}
+          export AZURE_CLIENT_SECRET=${{ secrets.AZURE_CLIENT_SECRET }}
+          export AZURE_SUBSCRIPTION_ID="${{ secrets.AZURE_SUBSCRIPTION_ID }}"
+          export GPT_MIN_CAPACITY="140"
+          export AZURE_REGIONS="${{ vars.AZURE_REGIONS }}"
+
+          chmod +x infra/scripts/checkquota.sh
+          if ! infra/scripts/checkquota.sh; then
+            # If quota check fails due to insufficient quota, set the flag
+            if grep -q "No region with sufficient quota found" infra/scripts/checkquota.sh; then
+              echo "QUOTA_FAILED=true" >> $GITHUB_ENV
+            fi
+            exit 1  # Fail the pipeline if any other failure occurs
+          fi
+
+      - name: Send Notification on Quota Failure
+        if: env.QUOTA_FAILED == 'true'
+        run: |
+          RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+          EMAIL_BODY=$(cat <<EOF
+          {
+            "body": "<p>Dear Team,</p><p>The quota check has failed, and the pipeline cannot proceed.</p><p><strong>Build URL:</strong> ${RUN_URL}</p><p>Please take necessary action.</p><p>Best regards,<br>Your Automation Team</p>"
+          }
+          EOF
+          )
 
-      - name: Set up Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: "3.13"
+          curl -X POST "${{ secrets.AUTO_LOGIC_APP_URL }}" \
+            -H "Content-Type: application/json" \
+            -d "$EMAIL_BODY" || echo "Failed to send notification"
 
-      - name: Azure CLI Login
-        uses: azure/login@v2
-        with:
-          creds: '{"clientId":"${{ secrets.AZURE_CLIENT_ID }}","clientSecret":"${{ secrets.AZURE_CLIENT_SECRET }}","subscriptionId":"${{ secrets.AZURE_SUBSCRIPTION_ID }}","tenantId":"${{ secrets.AZURE_TENANT_ID }}"}'
+      - name: Fail Pipeline if Quota Check Fails
+        if: env.QUOTA_FAILED == 'true'
+        run: exit 1
+
+      - name: Set Deployment Region
+        run: |
+          echo "Selected Region: $VALID_REGION"
+          echo "AZURE_LOCATION=$VALID_REGION" >> $GITHUB_ENV
 
-      - name: Start Container App
-        uses: azure/cli@v2
-        with:
-          azcliversion: "latest"
-          inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/start?api-version=2025-01-01"
+      - name: Setup Azure CLI
+        run: |
+          curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
+          az --version  # Verify installation
 
-      - name: Install dependencies
+      - name: Login to Azure
         run: |
-          python -m pip install --upgrade pip
-          pip install -r tests/e2e-test/requirements.txt
+          az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
 
-      - name: Ensure browsers are installed
-        run: python -m playwright install --with-deps chromium
+      - name: Install Bicep CLI
+        run: az bicep install
 
-      - name: Validate Inputs
+      - name: Generate Resource Group Name
+        id: generate_rg_name
         run: |
-          if [ -z "${{ env.MACAE_WEB_URL }}" ]; then
-            echo "ERROR: No Web URL provided for testing"
-            exit 1
-          elif [ -z "${{ env.MACAE_URL_API  }}" ]; then
-            echo "ERROR: No API URL provided for testing"
-            exit 1
-          elif [ -z "${{ env.MACAE_RG }}" ]; then
-            echo "ERROR: Resource group name missing"
-            exit 1
-          elif [ -z "${{ env.MACAE_CONTAINER_APP }}" ]; then
-            echo "ERROR: Container app name missing"
-            exit 1
+          ACCL_NAME="macae"
+          SHORT_UUID=$(uuidgen | cut -d'-' -f1)
+          UNIQUE_RG_NAME="arg-${ACCL_NAME}-${SHORT_UUID}"
+          echo "RESOURCE_GROUP_NAME=${UNIQUE_RG_NAME}" >> $GITHUB_ENV
+          echo "Generated Resource_GROUP_PREFIX: ${UNIQUE_RG_NAME}"
+
+      - name: Check and Create Resource Group
+        id: check_create_rg
+        run: |
+          set -e
+          rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
+          if [ "$rg_exists" = "false" ]; then
+            az group create --name ${{ env.RESOURCE_GROUP_NAME }} --location ${{ env.AZURE_LOCATION }}
           fi
+          echo "RESOURCE_GROUP_NAME=${{ env.RESOURCE_GROUP_NAME }}" >> $GITHUB_OUTPUT
 
-      - name: Wait for Application to be Ready
+      - name: Generate Unique Solution Prefix
+        id: generate_solution_prefix
         run: |
-          echo "Waiting for application to be ready at ${{ env.MACAE_WEB_URL }}"
-          max_attempts=10
-          attempt=1
-          while [ $attempt -le $max_attempts ]; do
-            echo "Attempt $attempt: Checking if application is ready..."
-            if curl -f -s "${{ env.MACAE_WEB_URL }}" > /dev/null; then
-              echo "Application is ready!"
-              break
-            fi
-            if [ $attempt -eq $max_attempts ]; then
-              echo "Application is not ready after $max_attempts attempts"
-              exit 1
+          COMMON_PART="macae"
+          TIMESTAMP=$(date +%s)
+          UPDATED_TIMESTAMP=$(echo $TIMESTAMP | tail -c 6)
+          UNIQUE_SOLUTION_PREFIX="${COMMON_PART}${UPDATED_TIMESTAMP}"
+          echo "SOLUTION_PREFIX=${UNIQUE_SOLUTION_PREFIX}" >> $GITHUB_ENV
+
+      - name: Deploy Bicep Template
+        id: deploy
+        run: |
+          if [[ "${{ env.BRANCH_NAME }}" == "main" ]]; then
+            IMAGE_TAG="latest"
+          elif [[ "${{ env.BRANCH_NAME }}" == "hotfix" ]]; then
+            IMAGE_TAG="hotfix"
+          else
+            IMAGE_TAG="latest"
+          fi
+
+          az deployment group create \
+            --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
+            --template-file infra/main.bicep \
+            --parameters \
+              solutionPrefix=${{ env.SOLUTION_PREFIX }} \
+              solutionLocation="${{ env.AZURE_LOCATION }}" \
+              azureOpenAILocation="${{ env.AZURE_LOCATION }}" \
+              modelDeploymentType="GlobalStandard" \
+              gptModelName="gpt-4o" \
+              gptModelVersion="2024-08-06" \
+              imageTag="${IMAGE_TAG}" \
+            --output json
+
+      - name: Extract Web App and API App URLs
+        id: get_output
+        run: |
+          WEBAPP_NAMES=$(az webapp list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --query "[].name" -o tsv)
+          for NAME in $WEBAPP_NAMES; do
+            if [[ $NAME == app-* ]]; then
+              WEBAPP_URL="https://${NAME}.azurewebsites.net"
+              echo "WEBAPP_URL=$WEBAPP_URL" >> $GITHUB_OUTPUT
             fi
-            echo "Application not ready, waiting 30 seconds..."
-            sleep 30
-            attempt=$((attempt + 1))
           done
 
-      - name: Run tests (1)
-        id: test1
+      - name: Get Container App Backend URL
+        id: get_backend_url
         run: |
-          xvfb-run pytest --headed --html=report/report.html --self-contained-html
-        working-directory: tests/e2e-test
-        continue-on-error: true
+          CONTAINER_APP_NAME=$(az containerapp list \
+            --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
+            --query "[0].name" -o tsv)
+
+          MACAE_URL_API=$(az containerapp show \
+            --name "$CONTAINER_APP_NAME" \
+            --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
+            --query "properties.configuration.ingress.fqdn" -o tsv)
+
+          echo "MACAE_URL_API=https://${MACAE_URL_API}" >> $GITHUB_OUTPUT
+          echo "CONTAINER_APP=${CONTAINER_APP_NAME}" >> $GITHUB_OUTPUT
+
+      - name: Set Deployment Status
+        id: deployment_status
+        if: always()
+        run: |
+          if [ "${{ job.status }}" == "success" ]; then
+            echo "SUCCESS=true" >> $GITHUB_OUTPUT
+          else
+            echo "SUCCESS=false" >> $GITHUB_OUTPUT
+          fi
+
+  e2e-test:
+    needs: deploy
+    if: needs.deploy.outputs.DEPLOYMENT_SUCCESS == 'true'
+    uses: ./.github/workflows/test-automation.yml
+    with:
+      MACAE_WEB_URL: ${{ needs.deploy.outputs.WEBAPP_URL }}
+      MACAE_URL_API: ${{ needs.deploy.outputs.MACAE_URL_API }}
+      MACAE_RG: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
+      MACAE_CONTAINER_APP: ${{ needs.deploy.outputs.CONTAINER_APP }}
+    secrets: inherit
 
-      - name: Sleep for 30 seconds
-        if: steps.test1.outcome == 'failure'
-        run: sleep 30s
-        shell: bash
+  cleanup-deployment:
+    if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
+    needs: [deploy, e2e-test]
+    runs-on: ubuntu-latest
+    env:
+      RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
+    steps:
+      - name: Setup Azure CLI
+        run: |
+          curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
+          az --version
+      - name: Login to Azure
+        run: |
+          az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
+          az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
 
-      - name: Run tests (2)
-        id: test2
-        if: steps.test1.outcome == 'failure'
+      - name: Extract AI Services and Key Vault Names
+        if: always()
         run: |
-          xvfb-run pytest --headed --html=report/report.html --self-contained-html
-        working-directory: tests/e2e-test
-        continue-on-error: true
+          echo "Fetching AI Services and Key Vault names before deletion..."
 
-      - name: Sleep for 60 seconds
-        if: steps.test2.outcome == 'failure'
-        run: sleep 60s
-        shell: bash
+          # Get Key Vault name
+          KEYVAULT_NAME=$(az resource list --resource-group "${{ env.RESOURCE_GROUP_NAME }}" --resource-type "Microsoft.KeyVault/vaults" --query "[].name" -o tsv)
+          echo "Detected Key Vault: $KEYVAULT_NAME"
+          echo "KEYVAULT_NAME=$KEYVAULT_NAME" >> $GITHUB_ENV
+          # Extract AI Services names
+          echo "Fetching AI Services..."
+          AI_SERVICES=$(az resource list --resource-group '${{ env.RESOURCE_GROUP_NAME }}' --resource-type "Microsoft.CognitiveServices/accounts" --query "[].name" -o tsv)
+          # Flatten newline-separated values to space-separated
+          AI_SERVICES=$(echo "$AI_SERVICES" | paste -sd ' ' -)
+          echo "Detected AI Services: $AI_SERVICES"
+          echo "AI_SERVICES=$AI_SERVICES" >> $GITHUB_ENV
 
-      - name: Run tests (3)
-        id: test3
-        if: steps.test2.outcome == 'failure'
+      - name: Get OpenAI Resource from Resource Group
+        id: get_openai_resource
         run: |
-          xvfb-run pytest --headed --html=report/report.html --self-contained-html
-        working-directory: tests/e2e-test
 
-      - name: Upload test report
-        id: upload_report
-        uses: actions/upload-artifact@v4
-        if: ${{ !cancelled() }}
-        with:
-          name: test-report-${{ github.run_id }}
-          path: tests/e2e-test/report/*
+          set -e
+          echo "Fetching OpenAI resource from resource group ${{ env.RESOURCE_GROUP_NAME }}..."
+
+          # Run the az resource list command to get the OpenAI resource name
+          openai_resource_name=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.CognitiveServices/accounts" --query "[0].name" -o tsv)
+
+          if [ -z "$openai_resource_name" ]; then
+            echo "No OpenAI resource found in resource group ${{ env.RESOURCE_GROUP_NAME }}."
+            exit 1
+          else
+            echo "OPENAI_RESOURCE_NAME=${openai_resource_name}" >> $GITHUB_ENV
+            echo "OpenAI resource name: ${openai_resource_name}"
+          fi
 
-      - name: Determine Test Result
-        id: test_result
+      - name: Delete Bicep Deployment
+        if: always()
         run: |
-          if [[ "${{ steps.test1.outcome }}" == "success" || "${{ steps.test2.outcome }}" == "success" || "${{ steps.test3.outcome }}" == "success" ]]; then
-            echo "IS_SUCCESS=true" >> $GITHUB_OUTPUT
-            echo "✅ Tests passed!"
+          set -e
+          echo "Checking if resource group exists..."
+          rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
+          if [ "$rg_exists" = "true" ]; then
+            echo "Resource group exist. Cleaning..."
+            az group delete \
+                --name ${{ env.RESOURCE_GROUP_NAME }} \
+                --yes \
+                --no-wait
+            echo "Resource group deleted...  ${{ env.RESOURCE_GROUP_NAME }}"
           else
-            echo "IS_SUCCESS=false" >> $GITHUB_OUTPUT
-            echo "❌ All test attempts failed"
-            exit 1
+            echo "Resource group does not exists."
           fi
 
-      - name: Send Notification
+      - name: Wait for resource deletion to complete
+        run: |
+
+          # Add resources to the array
+          resources_to_check=("${{ env.OPENAI_RESOURCE_NAME }}")
+
+          echo "List of resources to check: ${resources_to_check[@]}"
+
+          # Maximum number of retries
+          max_retries=3
+
+          # Retry intervals in seconds (30, 60, 120)
+          retry_intervals=(30 60 120)
+
+          # Retry mechanism to check resources
+          retries=0
+          while true; do
+            resource_found=false
+
+            # Get the list of resources in YAML format again on each retry
+            resource_list=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --output yaml)
+
+            # Iterate through the resources to check
+            for resource in "${resources_to_check[@]}"; do
+              echo "Checking resource: $resource"
+              if echo "$resource_list" | grep -q "name: $resource"; then
+                echo "Resource '$resource' exists in the resource group."
+                resource_found=true
+              else
+                echo "Resource '$resource' does not exist in the resource group."
+              fi
+            done
+
+            # If any resource exists, retry
+            if [ "$resource_found" = true ]; then
+              retries=$((retries + 1))
+              if [ "$retries" -gt "$max_retries" ]; then
+                echo "Maximum retry attempts reached. Exiting."
+                break
+              else
+                # Wait for the appropriate interval for the current retry
+                echo "Waiting for ${retry_intervals[$retries-1]} seconds before retrying..."
+                sleep ${retry_intervals[$retries-1]}
+              fi
+            else
+              echo "No resources found. Exiting."
+              break
+            fi
+          done
+
+      - name: Purging the Resources
         if: always()
         run: |
-          RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-          REPORT_URL=${{ steps.upload_report.outputs.artifact-url }}
-          IS_SUCCESS=${{ steps.test_result.outputs.IS_SUCCESS }}
-
-          if [ "$IS_SUCCESS" = "true" ]; then
-                  EMAIL_BODY=$(cat <<EOF
-                  {
-                    "body": "<p>Dear Team,</p><p>We would like to inform you that the ${{ env.accelerator_name }} Test Automation process has completed successfully.</p><p><strong>Run URL:</strong> <a href=\\"${RUN_URL}\\">${RUN_URL}</a><br></p><p><strong>Test Report:</strong> <a href=\\"${REPORT_URL}\\">${REPORT_URL}</a></p><p>Best regards,<br>Your Automation Team</p>",
-                    "subject": "${{ env.accelerator_name }} Test Automation - Success"
-                  }
-          EOF
-            )
+
+          set -e
+          echo "Azure OpenAI: ${{ env.OPENAI_RESOURCE_NAME }}"
+
+          # Purge OpenAI Resource
+          echo "Purging the OpenAI Resource..."
+          if ! az resource delete --ids /subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/providers/Microsoft.CognitiveServices/locations/eastus/resourceGroups/${{ env.RESOURCE_GROUP_NAME }}/deletedAccounts/${{ env.OPENAI_RESOURCE_NAME }} --verbose; then
+            echo "Failed to purge openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
           else
-                  EMAIL_BODY=$(cat <<EOF
-                  {
-                    "body": "<p>Dear Team,</p><p>We would like to inform you that the ${{ env.accelerator_name }} Test Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Run URL:</strong> <a href=\\"${RUN_URL}\\">${RUN_URL}</a><br></p><p><strong>Test Report:</strong> <a href=\\"${REPORT_URL}\\">${REPORT_URL}</a></p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>",
-                    "subject": "${{ env.accelerator_name }} Test Automation - Failure"
-                  }
-          EOF
-            )
+            echo "Purged the openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
           fi
 
-          curl -X POST "${{ secrets.EMAILNOTIFICATION_LOGICAPP_URL_TA }}" \
+          echo "Resource purging completed successfully"
+
+      - name: Send Notification on Failure
+        if: failure()
+        run: |
+          RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
+          # Construct the email body
+          EMAIL_BODY=$(cat <<EOF
+          {
+            "body": "<p>Dear Team,</p><p>We would like to inform you that the Multi-Agent-Custom-Automation-Engine-Solution-Accelerator Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Build URL:</strong> ${RUN_URL}<br> ${OUTPUT}</p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>"
+          }
+          EOF
+          )
+
+          # Send the notification
+          curl -X POST "${{ secrets.LOGIC_APP_URL }}" \
             -H "Content-Type: application/json" \
             -d "$EMAIL_BODY" || echo "Failed to send notification"
-
-      - name: Stop Container App
+      - name: Logout from Azure
         if: always()
-        uses: azure/cli@v2
-        with:
-          azcliversion: "latest"
-          inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/stop?api-version=2025-01-01"
-            az logout
+        run: |
+          az logout
+          echo "Logged out from Azure."

From c5c102c89d9d3d5423be3511f8a37c8687465618 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Thu, 10 Jul 2025 21:08:21 +0530
Subject: [PATCH 52/70] update

---
 .github/workflows/deploy-waf.yml | 1 +
 .github/workflows/deploy.yml     | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.github/workflows/deploy-waf.yml b/.github/workflows/deploy-waf.yml
index 962df619e..b5e6c1462 100644
--- a/.github/workflows/deploy-waf.yml
+++ b/.github/workflows/deploy-waf.yml
@@ -9,6 +9,7 @@ on:
     branches:
       - main
       - hotfix
+      - dev
   schedule:
     - cron: "0 11,23 * * *" # Runs at 11:00 AM and 11:00 PM GMT
   workflow_dispatch: #Allow manual triggering
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index e11a29790..b35db605e 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -9,6 +9,7 @@ on:
     branches:
       - main
       - hotfix
+      - dev
   schedule:
     - cron: "0 11,23 * * *" # Runs at 11:00 AM and 11:00 PM GMT
   workflow_dispatch: #Allow manual triggering

From 298115c35f0396ca8012a382f583667f6c764746 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Thu, 10 Jul 2025 21:11:23 +0530
Subject: [PATCH 53/70] edit

---
 .github/workflows/deploy.yml | 18 ------------------
 1 file changed, 18 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index b35db605e..68d5af1e6 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -9,7 +9,6 @@ on:
     branches:
       - main
       - hotfix
-      - dev
   schedule:
     - cron: "0 11,23 * * *" # Runs at 11:00 AM and 11:00 PM GMT
   workflow_dispatch: #Allow manual triggering
@@ -39,7 +38,6 @@ jobs:
           export AZURE_SUBSCRIPTION_ID="${{ secrets.AZURE_SUBSCRIPTION_ID }}"
           export GPT_MIN_CAPACITY="140"
           export AZURE_REGIONS="${{ vars.AZURE_REGIONS }}"
-
           chmod +x infra/scripts/checkquota.sh
           if ! infra/scripts/checkquota.sh; then
             # If quota check fails due to insufficient quota, set the flag
@@ -48,7 +46,6 @@ jobs:
             fi
             exit 1  # Fail the pipeline if any other failure occurs
           fi
-
       - name: Send Notification on Quota Failure
         if: env.QUOTA_FAILED == 'true'
         run: |
@@ -59,11 +56,9 @@ jobs:
           }
           EOF
           )
-
           curl -X POST "${{ secrets.AUTO_LOGIC_APP_URL }}" \
             -H "Content-Type: application/json" \
             -d "$EMAIL_BODY" || echo "Failed to send notification"
-
       - name: Fail Pipeline if Quota Check Fails
         if: env.QUOTA_FAILED == 'true'
         run: exit 1
@@ -72,16 +67,13 @@ jobs:
         run: |
           echo "Selected Region: $VALID_REGION"
           echo "AZURE_LOCATION=$VALID_REGION" >> $GITHUB_ENV
-
       - name: Setup Azure CLI
         run: |
           curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
           az --version  # Verify installation
-
       - name: Login to Azure
         run: |
           az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
-
       - name: Install Bicep CLI
         run: az bicep install
 
@@ -93,7 +85,6 @@ jobs:
           UNIQUE_RG_NAME="arg-${ACCL_NAME}-${SHORT_UUID}"
           echo "RESOURCE_GROUP_NAME=${UNIQUE_RG_NAME}" >> $GITHUB_ENV
           echo "Generated Resource_GROUP_PREFIX: ${UNIQUE_RG_NAME}"
-
       - name: Check and Create Resource Group
         id: check_create_rg
         run: |
@@ -103,7 +94,6 @@ jobs:
             az group create --name ${{ env.RESOURCE_GROUP_NAME }} --location ${{ env.AZURE_LOCATION }}
           fi
           echo "RESOURCE_GROUP_NAME=${{ env.RESOURCE_GROUP_NAME }}" >> $GITHUB_OUTPUT
-
       - name: Generate Unique Solution Prefix
         id: generate_solution_prefix
         run: |
@@ -112,7 +102,6 @@ jobs:
           UPDATED_TIMESTAMP=$(echo $TIMESTAMP | tail -c 6)
           UNIQUE_SOLUTION_PREFIX="${COMMON_PART}${UPDATED_TIMESTAMP}"
           echo "SOLUTION_PREFIX=${UNIQUE_SOLUTION_PREFIX}" >> $GITHUB_ENV
-
       - name: Deploy Bicep Template
         id: deploy
         run: |
@@ -123,7 +112,6 @@ jobs:
           else
             IMAGE_TAG="latest"
           fi
-
           az deployment group create \
             --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
             --template-file infra/main.bicep \
@@ -136,7 +124,6 @@ jobs:
               gptModelVersion="2024-08-06" \
               imageTag="${IMAGE_TAG}" \
             --output json
-
       - name: Extract Web App and API App URLs
         id: get_output
         run: |
@@ -147,22 +134,18 @@ jobs:
               echo "WEBAPP_URL=$WEBAPP_URL" >> $GITHUB_OUTPUT
             fi
           done
-
       - name: Get Container App Backend URL
         id: get_backend_url
         run: |
           CONTAINER_APP_NAME=$(az containerapp list \
             --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
             --query "[0].name" -o tsv)
-
           MACAE_URL_API=$(az containerapp show \
             --name "$CONTAINER_APP_NAME" \
             --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
             --query "properties.configuration.ingress.fqdn" -o tsv)
-
           echo "MACAE_URL_API=https://${MACAE_URL_API}" >> $GITHUB_OUTPUT
           echo "CONTAINER_APP=${CONTAINER_APP_NAME}" >> $GITHUB_OUTPUT
-
       - name: Set Deployment Status
         id: deployment_status
         if: always()
@@ -172,7 +155,6 @@ jobs:
           else
             echo "SUCCESS=false" >> $GITHUB_OUTPUT
           fi
-
   e2e-test:
     needs: deploy
     if: needs.deploy.outputs.DEPLOYMENT_SUCCESS == 'true'

From 0d74aef4884d4f2ad700ab103a150be8607344f0 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Thu, 10 Jul 2025 21:15:15 +0530
Subject: [PATCH 54/70] edit

---
 .github/workflows/deploy.yml | 304 +++++++++++++++++++----------------
 1 file changed, 161 insertions(+), 143 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 68d5af1e6..df9ab4a13 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -9,6 +9,7 @@ on:
     branches:
       - main
       - hotfix
+      - dev
   schedule:
     - cron: "0 11,23 * * *" # Runs at 11:00 AM and 11:00 PM GMT
   workflow_dispatch: #Allow manual triggering
@@ -38,6 +39,7 @@ jobs:
           export AZURE_SUBSCRIPTION_ID="${{ secrets.AZURE_SUBSCRIPTION_ID }}"
           export GPT_MIN_CAPACITY="140"
           export AZURE_REGIONS="${{ vars.AZURE_REGIONS }}"
+
           chmod +x infra/scripts/checkquota.sh
           if ! infra/scripts/checkquota.sh; then
             # If quota check fails due to insufficient quota, set the flag
@@ -46,6 +48,7 @@ jobs:
             fi
             exit 1  # Fail the pipeline if any other failure occurs
           fi
+
       - name: Send Notification on Quota Failure
         if: env.QUOTA_FAILED == 'true'
         run: |
@@ -56,9 +59,11 @@ jobs:
           }
           EOF
           )
+
           curl -X POST "${{ secrets.AUTO_LOGIC_APP_URL }}" \
             -H "Content-Type: application/json" \
             -d "$EMAIL_BODY" || echo "Failed to send notification"
+
       - name: Fail Pipeline if Quota Check Fails
         if: env.QUOTA_FAILED == 'true'
         run: exit 1
@@ -67,13 +72,16 @@ jobs:
         run: |
           echo "Selected Region: $VALID_REGION"
           echo "AZURE_LOCATION=$VALID_REGION" >> $GITHUB_ENV
+
       - name: Setup Azure CLI
         run: |
           curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
           az --version  # Verify installation
+
       - name: Login to Azure
         run: |
           az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
+
       - name: Install Bicep CLI
         run: az bicep install
 
@@ -85,6 +93,7 @@ jobs:
           UNIQUE_RG_NAME="arg-${ACCL_NAME}-${SHORT_UUID}"
           echo "RESOURCE_GROUP_NAME=${UNIQUE_RG_NAME}" >> $GITHUB_ENV
           echo "Generated Resource_GROUP_PREFIX: ${UNIQUE_RG_NAME}"
+
       - name: Check and Create Resource Group
         id: check_create_rg
         run: |
@@ -94,6 +103,7 @@ jobs:
             az group create --name ${{ env.RESOURCE_GROUP_NAME }} --location ${{ env.AZURE_LOCATION }}
           fi
           echo "RESOURCE_GROUP_NAME=${{ env.RESOURCE_GROUP_NAME }}" >> $GITHUB_OUTPUT
+
       - name: Generate Unique Solution Prefix
         id: generate_solution_prefix
         run: |
@@ -102,6 +112,7 @@ jobs:
           UPDATED_TIMESTAMP=$(echo $TIMESTAMP | tail -c 6)
           UNIQUE_SOLUTION_PREFIX="${COMMON_PART}${UPDATED_TIMESTAMP}"
           echo "SOLUTION_PREFIX=${UNIQUE_SOLUTION_PREFIX}" >> $GITHUB_ENV
+
       - name: Deploy Bicep Template
         id: deploy
         run: |
@@ -112,6 +123,7 @@ jobs:
           else
             IMAGE_TAG="latest"
           fi
+
           az deployment group create \
             --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
             --template-file infra/main.bicep \
@@ -124,6 +136,7 @@ jobs:
               gptModelVersion="2024-08-06" \
               imageTag="${IMAGE_TAG}" \
             --output json
+
       - name: Extract Web App and API App URLs
         id: get_output
         run: |
@@ -134,18 +147,22 @@ jobs:
               echo "WEBAPP_URL=$WEBAPP_URL" >> $GITHUB_OUTPUT
             fi
           done
+
       - name: Get Container App Backend URL
         id: get_backend_url
         run: |
           CONTAINER_APP_NAME=$(az containerapp list \
             --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
             --query "[0].name" -o tsv)
+
           MACAE_URL_API=$(az containerapp show \
             --name "$CONTAINER_APP_NAME" \
             --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
             --query "properties.configuration.ingress.fqdn" -o tsv)
+
           echo "MACAE_URL_API=https://${MACAE_URL_API}" >> $GITHUB_OUTPUT
           echo "CONTAINER_APP=${CONTAINER_APP_NAME}" >> $GITHUB_OUTPUT
+
       - name: Set Deployment Status
         id: deployment_status
         if: always()
@@ -155,6 +172,7 @@ jobs:
           else
             echo "SUCCESS=false" >> $GITHUB_OUTPUT
           fi
+
   e2e-test:
     needs: deploy
     if: needs.deploy.outputs.DEPLOYMENT_SUCCESS == 'true'
@@ -166,160 +184,160 @@ jobs:
       MACAE_CONTAINER_APP: ${{ needs.deploy.outputs.CONTAINER_APP }}
     secrets: inherit
 
-  cleanup-deployment:
-    if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
-    needs: [deploy, e2e-test]
-    runs-on: ubuntu-latest
-    env:
-      RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
-    steps:
-      - name: Setup Azure CLI
-        run: |
-          curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
-          az --version
-      - name: Login to Azure
-        run: |
-          az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
-          az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
+  # cleanup-deployment:
+  #   if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
+  #   needs: [deploy, e2e-test]
+  #   runs-on: ubuntu-latest
+  #   env:
+  #     RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
+  #   steps:
+  #     - name: Setup Azure CLI
+  #       run: |
+  #         curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
+  #         az --version
+  #     - name: Login to Azure
+  #       run: |
+  #         az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
+  #         az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
 
-      - name: Extract AI Services and Key Vault Names
-        if: always()
-        run: |
-          echo "Fetching AI Services and Key Vault names before deletion..."
-
-          # Get Key Vault name
-          KEYVAULT_NAME=$(az resource list --resource-group "${{ env.RESOURCE_GROUP_NAME }}" --resource-type "Microsoft.KeyVault/vaults" --query "[].name" -o tsv)
-          echo "Detected Key Vault: $KEYVAULT_NAME"
-          echo "KEYVAULT_NAME=$KEYVAULT_NAME" >> $GITHUB_ENV
-          # Extract AI Services names
-          echo "Fetching AI Services..."
-          AI_SERVICES=$(az resource list --resource-group '${{ env.RESOURCE_GROUP_NAME }}' --resource-type "Microsoft.CognitiveServices/accounts" --query "[].name" -o tsv)
-          # Flatten newline-separated values to space-separated
-          AI_SERVICES=$(echo "$AI_SERVICES" | paste -sd ' ' -)
-          echo "Detected AI Services: $AI_SERVICES"
-          echo "AI_SERVICES=$AI_SERVICES" >> $GITHUB_ENV
-
-      - name: Get OpenAI Resource from Resource Group
-        id: get_openai_resource
-        run: |
+  #     - name: Extract AI Services and Key Vault Names
+  #       if: always()
+  #       run: |
+  #         echo "Fetching AI Services and Key Vault names before deletion..."
 
-          set -e
-          echo "Fetching OpenAI resource from resource group ${{ env.RESOURCE_GROUP_NAME }}..."
+  #         # Get Key Vault name
+  #         KEYVAULT_NAME=$(az resource list --resource-group "${{ env.RESOURCE_GROUP_NAME }}" --resource-type "Microsoft.KeyVault/vaults" --query "[].name" -o tsv)
+  #         echo "Detected Key Vault: $KEYVAULT_NAME"
+  #         echo "KEYVAULT_NAME=$KEYVAULT_NAME" >> $GITHUB_ENV
+  #         # Extract AI Services names
+  #         echo "Fetching AI Services..."
+  #         AI_SERVICES=$(az resource list --resource-group '${{ env.RESOURCE_GROUP_NAME }}' --resource-type "Microsoft.CognitiveServices/accounts" --query "[].name" -o tsv)
+  #         # Flatten newline-separated values to space-separated
+  #         AI_SERVICES=$(echo "$AI_SERVICES" | paste -sd ' ' -)
+  #         echo "Detected AI Services: $AI_SERVICES"
+  #         echo "AI_SERVICES=$AI_SERVICES" >> $GITHUB_ENV
 
-          # Run the az resource list command to get the OpenAI resource name
-          openai_resource_name=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.CognitiveServices/accounts" --query "[0].name" -o tsv)
+  #     - name: Get OpenAI Resource from Resource Group
+  #       id: get_openai_resource
+  #       run: |
 
-          if [ -z "$openai_resource_name" ]; then
-            echo "No OpenAI resource found in resource group ${{ env.RESOURCE_GROUP_NAME }}."
-            exit 1
-          else
-            echo "OPENAI_RESOURCE_NAME=${openai_resource_name}" >> $GITHUB_ENV
-            echo "OpenAI resource name: ${openai_resource_name}"
-          fi
+  #         set -e
+  #         echo "Fetching OpenAI resource from resource group ${{ env.RESOURCE_GROUP_NAME }}..."
 
-      - name: Delete Bicep Deployment
-        if: always()
-        run: |
-          set -e
-          echo "Checking if resource group exists..."
-          rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
-          if [ "$rg_exists" = "true" ]; then
-            echo "Resource group exist. Cleaning..."
-            az group delete \
-                --name ${{ env.RESOURCE_GROUP_NAME }} \
-                --yes \
-                --no-wait
-            echo "Resource group deleted...  ${{ env.RESOURCE_GROUP_NAME }}"
-          else
-            echo "Resource group does not exists."
-          fi
+  #         # Run the az resource list command to get the OpenAI resource name
+  #         openai_resource_name=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.CognitiveServices/accounts" --query "[0].name" -o tsv)
 
-      - name: Wait for resource deletion to complete
-        run: |
+  #         if [ -z "$openai_resource_name" ]; then
+  #           echo "No OpenAI resource found in resource group ${{ env.RESOURCE_GROUP_NAME }}."
+  #           exit 1
+  #         else
+  #           echo "OPENAI_RESOURCE_NAME=${openai_resource_name}" >> $GITHUB_ENV
+  #           echo "OpenAI resource name: ${openai_resource_name}"
+  #         fi
 
-          # Add resources to the array
-          resources_to_check=("${{ env.OPENAI_RESOURCE_NAME }}")
-
-          echo "List of resources to check: ${resources_to_check[@]}"
-
-          # Maximum number of retries
-          max_retries=3
-
-          # Retry intervals in seconds (30, 60, 120)
-          retry_intervals=(30 60 120)
-
-          # Retry mechanism to check resources
-          retries=0
-          while true; do
-            resource_found=false
-
-            # Get the list of resources in YAML format again on each retry
-            resource_list=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --output yaml)
-
-            # Iterate through the resources to check
-            for resource in "${resources_to_check[@]}"; do
-              echo "Checking resource: $resource"
-              if echo "$resource_list" | grep -q "name: $resource"; then
-                echo "Resource '$resource' exists in the resource group."
-                resource_found=true
-              else
-                echo "Resource '$resource' does not exist in the resource group."
-              fi
-            done
-
-            # If any resource exists, retry
-            if [ "$resource_found" = true ]; then
-              retries=$((retries + 1))
-              if [ "$retries" -gt "$max_retries" ]; then
-                echo "Maximum retry attempts reached. Exiting."
-                break
-              else
-                # Wait for the appropriate interval for the current retry
-                echo "Waiting for ${retry_intervals[$retries-1]} seconds before retrying..."
-                sleep ${retry_intervals[$retries-1]}
-              fi
-            else
-              echo "No resources found. Exiting."
-              break
-            fi
-          done
+  #     - name: Delete Bicep Deployment
+  #       if: always()
+  #       run: |
+  #         set -e
+  #         echo "Checking if resource group exists..."
+  #         rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
+  #         if [ "$rg_exists" = "true" ]; then
+  #           echo "Resource group exist. Cleaning..."
+  #           az group delete \
+  #               --name ${{ env.RESOURCE_GROUP_NAME }} \
+  #               --yes \
+  #               --no-wait
+  #           echo "Resource group deleted...  ${{ env.RESOURCE_GROUP_NAME }}"
+  #         else
+  #           echo "Resource group does not exists."
+  #         fi
 
-      - name: Purging the Resources
-        if: always()
-        run: |
+  #     - name: Wait for resource deletion to complete
+  #       run: |
 
-          set -e
-          echo "Azure OpenAI: ${{ env.OPENAI_RESOURCE_NAME }}"
+  #         # Add resources to the array
+  #         resources_to_check=("${{ env.OPENAI_RESOURCE_NAME }}")
 
-          # Purge OpenAI Resource
-          echo "Purging the OpenAI Resource..."
-          if ! az resource delete --ids /subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/providers/Microsoft.CognitiveServices/locations/eastus/resourceGroups/${{ env.RESOURCE_GROUP_NAME }}/deletedAccounts/${{ env.OPENAI_RESOURCE_NAME }} --verbose; then
-            echo "Failed to purge openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
-          else
-            echo "Purged the openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
-          fi
+  #         echo "List of resources to check: ${resources_to_check[@]}"
 
-          echo "Resource purging completed successfully"
+  #         # Maximum number of retries
+  #         max_retries=3
 
-      - name: Send Notification on Failure
-        if: failure()
-        run: |
-          RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+  #         # Retry intervals in seconds (30, 60, 120)
+  #         retry_intervals=(30 60 120)
 
-          # Construct the email body
-          EMAIL_BODY=$(cat <<EOF
-          {
-            "body": "<p>Dear Team,</p><p>We would like to inform you that the Multi-Agent-Custom-Automation-Engine-Solution-Accelerator Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Build URL:</strong> ${RUN_URL}<br> ${OUTPUT}</p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>"
-          }
-          EOF
-          )
+  #         # Retry mechanism to check resources
+  #         retries=0
+  #         while true; do
+  #           resource_found=false
 
-          # Send the notification
-          curl -X POST "${{ secrets.LOGIC_APP_URL }}" \
-            -H "Content-Type: application/json" \
-            -d "$EMAIL_BODY" || echo "Failed to send notification"
-      - name: Logout from Azure
-        if: always()
-        run: |
-          az logout
-          echo "Logged out from Azure."
+  #           # Get the list of resources in YAML format again on each retry
+  #           resource_list=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --output yaml)
+
+  #           # Iterate through the resources to check
+  #           for resource in "${resources_to_check[@]}"; do
+  #             echo "Checking resource: $resource"
+  #             if echo "$resource_list" | grep -q "name: $resource"; then
+  #               echo "Resource '$resource' exists in the resource group."
+  #               resource_found=true
+  #             else
+  #               echo "Resource '$resource' does not exist in the resource group."
+  #             fi
+  #           done
+
+  #           # If any resource exists, retry
+  #           if [ "$resource_found" = true ]; then
+  #             retries=$((retries + 1))
+  #             if [ "$retries" -gt "$max_retries" ]; then
+  #               echo "Maximum retry attempts reached. Exiting."
+  #               break
+  #             else
+  #               # Wait for the appropriate interval for the current retry
+  #               echo "Waiting for ${retry_intervals[$retries-1]} seconds before retrying..."
+  #               sleep ${retry_intervals[$retries-1]}
+  #             fi
+  #           else
+  #             echo "No resources found. Exiting."
+  #             break
+  #           fi
+  #         done
+
+  #     - name: Purging the Resources
+  #       if: always()
+  #       run: |
+
+  #         set -e
+  #         echo "Azure OpenAI: ${{ env.OPENAI_RESOURCE_NAME }}"
+
+  #         # Purge OpenAI Resource
+  #         echo "Purging the OpenAI Resource..."
+  #         if ! az resource delete --ids /subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/providers/Microsoft.CognitiveServices/locations/eastus/resourceGroups/${{ env.RESOURCE_GROUP_NAME }}/deletedAccounts/${{ env.OPENAI_RESOURCE_NAME }} --verbose; then
+  #           echo "Failed to purge openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
+  #         else
+  #           echo "Purged the openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
+  #         fi
+
+  #         echo "Resource purging completed successfully"
+
+  #     - name: Send Notification on Failure
+  #       if: failure()
+  #       run: |
+  #         RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
+  #         # Construct the email body
+  #         EMAIL_BODY=$(cat <<EOF
+  #         {
+  #           "body": "<p>Dear Team,</p><p>We would like to inform you that the Multi-Agent-Custom-Automation-Engine-Solution-Accelerator Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Build URL:</strong> ${RUN_URL}<br> ${OUTPUT}</p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>"
+  #         }
+  #         EOF
+  #         )
+
+  #         # Send the notification
+  #         curl -X POST "${{ secrets.LOGIC_APP_URL }}" \
+  #           -H "Content-Type: application/json" \
+  #           -d "$EMAIL_BODY" || echo "Failed to send notification"
+  #     - name: Logout from Azure
+  #       if: always()
+  #       run: |
+  #         az logout
+  #         echo "Logged out from Azure."

From 4c4685ba90ef59868257769587a36131b202984b Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Thu, 10 Jul 2025 21:21:11 +0530
Subject: [PATCH 55/70] edit

---
 .github/workflows/test-automation.yml | 446 +++++++++-----------------
 1 file changed, 151 insertions(+), 295 deletions(-)

diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index 049935177..7ed7df8b7 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -2,341 +2,197 @@ name: Test Automation MACAE
 
 on:
   push:
-  workflow_run:
-    workflows: ["Build Docker and Optional Push"]
-    types:
-      - completed
     branches:
       - main
+      - dev
       - hotfix
+    paths:
+      - "tests/e2e-test/**"
   schedule:
-    - cron: "0 11,23 * * *" # Runs at 11:00 AM and 11:00 PM GMT
-  workflow_dispatch: #Allow manual triggering
-env:
-  GPT_MIN_CAPACITY: 140
-  BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
+    - cron: "0 13 * * *"
+  workflow_dispatch:
+  workflow_call:
+    inputs:
+      MACAE_WEB_URL:
+        required: false
+        type: string
+        description: "Web URL for MACAE (overrides environment variable)"
+      MACAE_URL_API:
+        required: false
+        type: string
+        description: "API URL for MACAE (overrides environment variable)"
+      MACAE_RG:
+        required: false
+        type: string
+      MACAE_CONTAINER_APP:
+        required: false
+        type: string
+    secrets:
+      EMAILNOTIFICATION_LOGICAPP_URL_TA:
+        required: false
+        description: "Logic App URL for email notifications"
 
 jobs:
-  deploy:
+  test:
     runs-on: ubuntu-latest
-    outputs:
-      RESOURCE_GROUP_NAME: ${{ steps.check_create_rg.outputs.RESOURCE_GROUP_NAME }}
-      WEBAPP_URL: ${{ steps.get_output.outputs.WEBAPP_URL }}
-      DEPLOYMENT_SUCCESS: ${{ steps.deployment_status.outputs.SUCCESS }}
-      MACAE_URL_API: ${{ steps.get_backend_url.outputs.MACAE_URL_API }}
-      CONTAINER_APP: ${{steps.get_backend_url.outputs.CONTAINER_APP}}
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@v3
-
-      - name: Run Quota Check
-        id: quota-check
-        run: |
-          export AZURE_CLIENT_ID=${{ secrets.AZURE_CLIENT_ID }}
-          export AZURE_TENANT_ID=${{ secrets.AZURE_TENANT_ID }}
-          export AZURE_CLIENT_SECRET=${{ secrets.AZURE_CLIENT_SECRET }}
-          export AZURE_SUBSCRIPTION_ID="${{ secrets.AZURE_SUBSCRIPTION_ID }}"
-          export GPT_MIN_CAPACITY="140"
-          export AZURE_REGIONS="${{ vars.AZURE_REGIONS }}"
-
-          chmod +x infra/scripts/checkquota.sh
-          if ! infra/scripts/checkquota.sh; then
-            # If quota check fails due to insufficient quota, set the flag
-            if grep -q "No region with sufficient quota found" infra/scripts/checkquota.sh; then
-              echo "QUOTA_FAILED=true" >> $GITHUB_ENV
-            fi
-            exit 1  # Fail the pipeline if any other failure occurs
-          fi
-
-      - name: Send Notification on Quota Failure
-        if: env.QUOTA_FAILED == 'true'
-        run: |
-          RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-          EMAIL_BODY=$(cat <<EOF
-          {
-            "body": "<p>Dear Team,</p><p>The quota check has failed, and the pipeline cannot proceed.</p><p><strong>Build URL:</strong> ${RUN_URL}</p><p>Please take necessary action.</p><p>Best regards,<br>Your Automation Team</p>"
-          }
-          EOF
-          )
+    env:
+      MACAE_WEB_URL: ${{ inputs.MACAE_WEB_URL }}
+      MACAE_URL_API: ${{ inputs.MACAE_URL_API }}
+      MACAE_RG: ${{ inputs.MACAE_RG }}
+      MACAE_CONTAINER_APP: ${{ inputs.MACAE_CONTAINER_APP }}
+      accelerator_name: "MACAE"
 
-          curl -X POST "${{ secrets.AUTO_LOGIC_APP_URL }}" \
-            -H "Content-Type: application/json" \
-            -d "$EMAIL_BODY" || echo "Failed to send notification"
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
 
-      - name: Fail Pipeline if Quota Check Fails
-        if: env.QUOTA_FAILED == 'true'
-        run: exit 1
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: "3.13"
 
-      - name: Set Deployment Region
-        run: |
-          echo "Selected Region: $VALID_REGION"
-          echo "AZURE_LOCATION=$VALID_REGION" >> $GITHUB_ENV
+      - name: Azure CLI Login
+        uses: azure/login@v2
+        with:
+          creds: '{"clientId":"${{ secrets.AZURE_CLIENT_ID }}","clientSecret":"${{ secrets.AZURE_CLIENT_SECRET }}","subscriptionId":"${{ secrets.AZURE_SUBSCRIPTION_ID }}","tenantId":"${{ secrets.AZURE_TENANT_ID }}"}'
 
-      - name: Setup Azure CLI
-        run: |
-          curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
-          az --version  # Verify installation
+      - name: Start Container App
+        uses: azure/cli@v2
+        with:
+          azcliversion: "latest"
+          inlineScript: |
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/start?api-version=2025-01-01"
 
-      - name: Login to Azure
+      - name: Install dependencies
         run: |
-          az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
-
-      - name: Install Bicep CLI
-        run: az bicep install
+          python -m pip install --upgrade pip
+          pip install -r tests/e2e-test/requirements.txt
 
-      - name: Generate Resource Group Name
-        id: generate_rg_name
-        run: |
-          ACCL_NAME="macae"
-          SHORT_UUID=$(uuidgen | cut -d'-' -f1)
-          UNIQUE_RG_NAME="arg-${ACCL_NAME}-${SHORT_UUID}"
-          echo "RESOURCE_GROUP_NAME=${UNIQUE_RG_NAME}" >> $GITHUB_ENV
-          echo "Generated Resource_GROUP_PREFIX: ${UNIQUE_RG_NAME}"
+      - name: Ensure browsers are installed
+        run: python -m playwright install --with-deps chromium
 
-      - name: Check and Create Resource Group
-        id: check_create_rg
+      - name: Validate Inputs
         run: |
-          set -e
-          rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
-          if [ "$rg_exists" = "false" ]; then
-            az group create --name ${{ env.RESOURCE_GROUP_NAME }} --location ${{ env.AZURE_LOCATION }}
-          fi
-          echo "RESOURCE_GROUP_NAME=${{ env.RESOURCE_GROUP_NAME }}" >> $GITHUB_OUTPUT
-
-      - name: Generate Unique Solution Prefix
-        id: generate_solution_prefix
-        run: |
-          COMMON_PART="macae"
-          TIMESTAMP=$(date +%s)
-          UPDATED_TIMESTAMP=$(echo $TIMESTAMP | tail -c 6)
-          UNIQUE_SOLUTION_PREFIX="${COMMON_PART}${UPDATED_TIMESTAMP}"
-          echo "SOLUTION_PREFIX=${UNIQUE_SOLUTION_PREFIX}" >> $GITHUB_ENV
-
-      - name: Deploy Bicep Template
-        id: deploy
-        run: |
-          if [[ "${{ env.BRANCH_NAME }}" == "main" ]]; then
-            IMAGE_TAG="latest"
-          elif [[ "${{ env.BRANCH_NAME }}" == "hotfix" ]]; then
-            IMAGE_TAG="hotfix"
-          else
-            IMAGE_TAG="latest"
+          if [ -z "${{ env.MACAE_WEB_URL }}" ]; then
+            echo "ERROR: No Web URL provided for testing"
+            exit 1
+          elif [ -z "${{ env.MACAE_URL_API  }}" ]; then
+            echo "ERROR: No API URL provided for testing"
+            exit 1
+          elif [ -z "${{ env.MACAE_RG }}" ]; then
+            echo "ERROR: Resource group name missing"
+            exit 1
+          elif [ -z "${{ env.MACAE_CONTAINER_APP }}" ]; then
+            echo "ERROR: Container app name missing"
+            exit 1
           fi
 
-          az deployment group create \
-            --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
-            --template-file infra/main.bicep \
-            --parameters \
-              solutionPrefix=${{ env.SOLUTION_PREFIX }} \
-              solutionLocation="${{ env.AZURE_LOCATION }}" \
-              azureOpenAILocation="${{ env.AZURE_LOCATION }}" \
-              modelDeploymentType="GlobalStandard" \
-              gptModelName="gpt-4o" \
-              gptModelVersion="2024-08-06" \
-              imageTag="${IMAGE_TAG}" \
-            --output json
-
-      - name: Extract Web App and API App URLs
-        id: get_output
+      - name: Wait for Application to be Ready
         run: |
-          WEBAPP_NAMES=$(az webapp list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --query "[].name" -o tsv)
-          for NAME in $WEBAPP_NAMES; do
-            if [[ $NAME == app-* ]]; then
-              WEBAPP_URL="https://${NAME}.azurewebsites.net"
-              echo "WEBAPP_URL=$WEBAPP_URL" >> $GITHUB_OUTPUT
+          echo "Waiting for application to be ready at ${{ env.MACAE_WEB_URL }}"
+          max_attempts=10
+          attempt=1
+          while [ $attempt -le $max_attempts ]; do
+            echo "Attempt $attempt: Checking if application is ready..."
+            if curl -f -s "${{ env.MACAE_WEB_URL }}" > /dev/null; then
+              echo "Application is ready!"
+              break
             fi
+            if [ $attempt -eq $max_attempts ]; then
+              echo "Application is not ready after $max_attempts attempts"
+              exit 1
+            fi
+            echo "Application not ready, waiting 30 seconds..."
+            sleep 30
+            attempt=$((attempt + 1))
           done
 
-      - name: Get Container App Backend URL
-        id: get_backend_url
+      - name: Run tests (1)
+        id: test1
         run: |
-          CONTAINER_APP_NAME=$(az containerapp list \
-            --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
-            --query "[0].name" -o tsv)
-
-          MACAE_URL_API=$(az containerapp show \
-            --name "$CONTAINER_APP_NAME" \
-            --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
-            --query "properties.configuration.ingress.fqdn" -o tsv)
-
-          echo "MACAE_URL_API=https://${MACAE_URL_API}" >> $GITHUB_OUTPUT
-          echo "CONTAINER_APP=${CONTAINER_APP_NAME}" >> $GITHUB_OUTPUT
-
-      - name: Set Deployment Status
-        id: deployment_status
-        if: always()
-        run: |
-          if [ "${{ job.status }}" == "success" ]; then
-            echo "SUCCESS=true" >> $GITHUB_OUTPUT
-          else
-            echo "SUCCESS=false" >> $GITHUB_OUTPUT
-          fi
-
-  e2e-test:
-    needs: deploy
-    if: needs.deploy.outputs.DEPLOYMENT_SUCCESS == 'true'
-    uses: ./.github/workflows/test-automation.yml
-    with:
-      MACAE_WEB_URL: ${{ needs.deploy.outputs.WEBAPP_URL }}
-      MACAE_URL_API: ${{ needs.deploy.outputs.MACAE_URL_API }}
-      MACAE_RG: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
-      MACAE_CONTAINER_APP: ${{ needs.deploy.outputs.CONTAINER_APP }}
-    secrets: inherit
+          xvfb-run pytest --headed --html=report/report.html --self-contained-html
+        working-directory: tests/e2e-test
+        continue-on-error: true
 
-  cleanup-deployment:
-    if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
-    needs: [deploy, e2e-test]
-    runs-on: ubuntu-latest
-    env:
-      RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
-    steps:
-      - name: Setup Azure CLI
-        run: |
-          curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
-          az --version
-      - name: Login to Azure
-        run: |
-          az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
-          az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
+      - name: Sleep for 30 seconds
+        if: steps.test1.outcome == 'failure'
+        run: sleep 30s
+        shell: bash
 
-      - name: Extract AI Services and Key Vault Names
-        if: always()
+      - name: Run tests (2)
+        id: test2
+        if: steps.test1.outcome == 'failure'
         run: |
-          echo "Fetching AI Services and Key Vault names before deletion..."
+          xvfb-run pytest --headed --html=report/report.html --self-contained-html
+        working-directory: tests/e2e-test
+        continue-on-error: true
 
-          # Get Key Vault name
-          KEYVAULT_NAME=$(az resource list --resource-group "${{ env.RESOURCE_GROUP_NAME }}" --resource-type "Microsoft.KeyVault/vaults" --query "[].name" -o tsv)
-          echo "Detected Key Vault: $KEYVAULT_NAME"
-          echo "KEYVAULT_NAME=$KEYVAULT_NAME" >> $GITHUB_ENV
-          # Extract AI Services names
-          echo "Fetching AI Services..."
-          AI_SERVICES=$(az resource list --resource-group '${{ env.RESOURCE_GROUP_NAME }}' --resource-type "Microsoft.CognitiveServices/accounts" --query "[].name" -o tsv)
-          # Flatten newline-separated values to space-separated
-          AI_SERVICES=$(echo "$AI_SERVICES" | paste -sd ' ' -)
-          echo "Detected AI Services: $AI_SERVICES"
-          echo "AI_SERVICES=$AI_SERVICES" >> $GITHUB_ENV
+      - name: Sleep for 60 seconds
+        if: steps.test2.outcome == 'failure'
+        run: sleep 60s
+        shell: bash
 
-      - name: Get OpenAI Resource from Resource Group
-        id: get_openai_resource
+      - name: Run tests (3)
+        id: test3
+        if: steps.test2.outcome == 'failure'
         run: |
+          xvfb-run pytest --headed --html=report/report.html --self-contained-html
+        working-directory: tests/e2e-test
 
-          set -e
-          echo "Fetching OpenAI resource from resource group ${{ env.RESOURCE_GROUP_NAME }}..."
-
-          # Run the az resource list command to get the OpenAI resource name
-          openai_resource_name=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.CognitiveServices/accounts" --query "[0].name" -o tsv)
-
-          if [ -z "$openai_resource_name" ]; then
-            echo "No OpenAI resource found in resource group ${{ env.RESOURCE_GROUP_NAME }}."
-            exit 1
-          else
-            echo "OPENAI_RESOURCE_NAME=${openai_resource_name}" >> $GITHUB_ENV
-            echo "OpenAI resource name: ${openai_resource_name}"
-          fi
+      - name: Upload test report
+        id: upload_report
+        uses: actions/upload-artifact@v4
+        if: ${{ !cancelled() }}
+        with:
+          name: test-report-${{ github.run_id }}
+          path: tests/e2e-test/report/*
 
-      - name: Delete Bicep Deployment
-        if: always()
+      - name: Determine Test Result
+        id: test_result
         run: |
-          set -e
-          echo "Checking if resource group exists..."
-          rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
-          if [ "$rg_exists" = "true" ]; then
-            echo "Resource group exist. Cleaning..."
-            az group delete \
-                --name ${{ env.RESOURCE_GROUP_NAME }} \
-                --yes \
-                --no-wait
-            echo "Resource group deleted...  ${{ env.RESOURCE_GROUP_NAME }}"
+          if [[ "${{ steps.test1.outcome }}" == "success" || "${{ steps.test2.outcome }}" == "success" || "${{ steps.test3.outcome }}" == "success" ]]; then
+            echo "IS_SUCCESS=true" >> $GITHUB_OUTPUT
+            echo "✅ Tests passed!"
           else
-            echo "Resource group does not exists."
+            echo "IS_SUCCESS=false" >> $GITHUB_OUTPUT
+            echo "❌ All test attempts failed"
+            exit 1
           fi
 
-      - name: Wait for resource deletion to complete
-        run: |
-
-          # Add resources to the array
-          resources_to_check=("${{ env.OPENAI_RESOURCE_NAME }}")
-
-          echo "List of resources to check: ${resources_to_check[@]}"
-
-          # Maximum number of retries
-          max_retries=3
-
-          # Retry intervals in seconds (30, 60, 120)
-          retry_intervals=(30 60 120)
-
-          # Retry mechanism to check resources
-          retries=0
-          while true; do
-            resource_found=false
-
-            # Get the list of resources in YAML format again on each retry
-            resource_list=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --output yaml)
-
-            # Iterate through the resources to check
-            for resource in "${resources_to_check[@]}"; do
-              echo "Checking resource: $resource"
-              if echo "$resource_list" | grep -q "name: $resource"; then
-                echo "Resource '$resource' exists in the resource group."
-                resource_found=true
-              else
-                echo "Resource '$resource' does not exist in the resource group."
-              fi
-            done
-
-            # If any resource exists, retry
-            if [ "$resource_found" = true ]; then
-              retries=$((retries + 1))
-              if [ "$retries" -gt "$max_retries" ]; then
-                echo "Maximum retry attempts reached. Exiting."
-                break
-              else
-                # Wait for the appropriate interval for the current retry
-                echo "Waiting for ${retry_intervals[$retries-1]} seconds before retrying..."
-                sleep ${retry_intervals[$retries-1]}
-              fi
-            else
-              echo "No resources found. Exiting."
-              break
-            fi
-          done
-
-      - name: Purging the Resources
+      - name: Send Notification
         if: always()
-        run: |
-
-          set -e
-          echo "Azure OpenAI: ${{ env.OPENAI_RESOURCE_NAME }}"
-
-          # Purge OpenAI Resource
-          echo "Purging the OpenAI Resource..."
-          if ! az resource delete --ids /subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/providers/Microsoft.CognitiveServices/locations/eastus/resourceGroups/${{ env.RESOURCE_GROUP_NAME }}/deletedAccounts/${{ env.OPENAI_RESOURCE_NAME }} --verbose; then
-            echo "Failed to purge openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
-          else
-            echo "Purged the openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
-          fi
-
-          echo "Resource purging completed successfully"
-
-      - name: Send Notification on Failure
-        if: failure()
         run: |
           RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-
-          # Construct the email body
-          EMAIL_BODY=$(cat <<EOF
-          {
-            "body": "<p>Dear Team,</p><p>We would like to inform you that the Multi-Agent-Custom-Automation-Engine-Solution-Accelerator Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Build URL:</strong> ${RUN_URL}<br> ${OUTPUT}</p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>"
-          }
+          REPORT_URL=${{ steps.upload_report.outputs.artifact-url }}
+          IS_SUCCESS=${{ steps.test_result.outputs.IS_SUCCESS }}
+
+          if [ "$IS_SUCCESS" = "true" ]; then
+                  EMAIL_BODY=$(cat <<EOF
+                  {
+                    "body": "<p>Dear Team,</p><p>We would like to inform you that the ${{ env.accelerator_name }} Test Automation process has completed successfully.</p><p><strong>Run URL:</strong> <a href=\\"${RUN_URL}\\">${RUN_URL}</a><br></p><p><strong>Test Report:</strong> <a href=\\"${REPORT_URL}\\">${REPORT_URL}</a></p><p>Best regards,<br>Your Automation Team</p>",
+                    "subject": "${{ env.accelerator_name }} Test Automation - Success"
+                  }
           EOF
-          )
+            )
+          else
+                  EMAIL_BODY=$(cat <<EOF
+                  {
+                    "body": "<p>Dear Team,</p><p>We would like to inform you that the ${{ env.accelerator_name }} Test Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Run URL:</strong> <a href=\\"${RUN_URL}\\">${RUN_URL}</a><br></p><p><strong>Test Report:</strong> <a href=\\"${REPORT_URL}\\">${REPORT_URL}</a></p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>",
+                    "subject": "${{ env.accelerator_name }} Test Automation - Failure"
+                  }
+          EOF
+            )
+          fi
 
-          # Send the notification
-          curl -X POST "${{ secrets.LOGIC_APP_URL }}" \
+          curl -X POST "${{ secrets.EMAILNOTIFICATION_LOGICAPP_URL_TA }}" \
             -H "Content-Type: application/json" \
             -d "$EMAIL_BODY" || echo "Failed to send notification"
-      - name: Logout from Azure
+
+      - name: Stop Container App
         if: always()
-        run: |
-          az logout
-          echo "Logged out from Azure."
+        uses: azure/cli@v2
+        with:
+          azcliversion: "latest"
+          inlineScript: |
+            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/stop?api-version=2025-01-01"
+            az logout

From 75af1fed048d830cb5ce33228dce92cae69259ce Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Thu, 10 Jul 2025 22:13:14 +0530
Subject: [PATCH 56/70] edit

---
 .github/workflows/deploy-waf.yml | 174 +++--------------
 .github/workflows/deploy.yml     | 314 +++++++++++++++----------------
 2 files changed, 186 insertions(+), 302 deletions(-)

diff --git a/.github/workflows/deploy-waf.yml b/.github/workflows/deploy-waf.yml
index b5e6c1462..7f0e6b67b 100644
--- a/.github/workflows/deploy-waf.yml
+++ b/.github/workflows/deploy-waf.yml
@@ -2,30 +2,14 @@ name: Validate WAF Deployment
 
 on:
   push:
-  workflow_run:
-    workflows: ["Build Docker and Optional Push"]
-    types:
-      - completed
     branches:
       - main
-      - hotfix
-      - dev
   schedule:
     - cron: "0 11,23 * * *" # Runs at 11:00 AM and 11:00 PM GMT
-  workflow_dispatch: #Allow manual triggering
-env:
-  GPT_MIN_CAPACITY: 140
-  BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
 
 jobs:
   deploy:
     runs-on: ubuntu-latest
-    outputs:
-      RESOURCE_GROUP_NAME: ${{ steps.check_create_rg.outputs.RESOURCE_GROUP_NAME }}
-      WEBAPP_URL: ${{ steps.get_output.outputs.WEBAPP_URL }}
-      DEPLOYMENT_SUCCESS: ${{ steps.deployment_status.outputs.SUCCESS }}
-      API_APP_URL: ${{ steps.get_backend_url.outputs.CONTAINER_APP_URL }}
-      CONTAINER_APP: ${{steps.get_backend_url.outputs.CONTAINER_APP}}
     steps:
       - name: Checkout Code
         uses: actions/checkout@v3
@@ -37,7 +21,7 @@ jobs:
           export AZURE_TENANT_ID=${{ secrets.AZURE_TENANT_ID }}
           export AZURE_CLIENT_SECRET=${{ secrets.AZURE_CLIENT_SECRET }}
           export AZURE_SUBSCRIPTION_ID="${{ secrets.AZURE_SUBSCRIPTION_ID }}"
-          export GPT_MIN_CAPACITY="140"
+          export GPT_MIN_CAPACITY="5"
           export AZURE_REGIONS="${{ vars.AZURE_REGIONS }}"
 
           chmod +x infra/scripts/checkquota.sh
@@ -88,7 +72,8 @@ jobs:
       - name: Generate Resource Group Name
         id: generate_rg_name
         run: |
-          ACCL_NAME="macae"
+          echo "Generating a unique resource group name..."
+          ACCL_NAME="macae"  # Account name as specified
           SHORT_UUID=$(uuidgen | cut -d'-' -f1)
           UNIQUE_RG_NAME="arg-${ACCL_NAME}-${SHORT_UUID}"
           echo "RESOURCE_GROUP_NAME=${UNIQUE_RG_NAME}" >> $GITHUB_ENV
@@ -97,125 +82,47 @@ jobs:
       - name: Check and Create Resource Group
         id: check_create_rg
         run: |
-          set -e
+          set -e  
+          echo "Checking if resource group exists..."
           rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
           if [ "$rg_exists" = "false" ]; then
-            az group create --name ${{ env.RESOURCE_GROUP_NAME }} --location ${{ env.AZURE_LOCATION }}
+            echo "Resource group does not exist. Creating..."
+            az group create --name ${{ env.RESOURCE_GROUP_NAME }} --location ${{ env.AZURE_LOCATION }} || { echo "Error creating resource group"; exit 1; }
+          else
+            echo "Resource group already exists."
           fi
-          echo "RESOURCE_GROUP_NAME=${{ env.RESOURCE_GROUP_NAME }}" >> $GITHUB_OUTPUT
-
-      - name: Generate Unique Solution Prefix
-        id: generate_solution_prefix
-        run: |
-          COMMON_PART="macae"
-          TIMESTAMP=$(date +%s)
-          UPDATED_TIMESTAMP=$(echo $TIMESTAMP | tail -c 6)
-          UNIQUE_SOLUTION_PREFIX="${COMMON_PART}${UPDATED_TIMESTAMP}"
-          echo "SOLUTION_PREFIX=${UNIQUE_SOLUTION_PREFIX}" >> $GITHUB_ENV
 
       - name: Deploy Bicep Template
         id: deploy
         run: |
-          if [[ "${{ env.BRANCH_NAME }}" == "main" ]]; then
-            IMAGE_TAG="latest"
-          elif [[ "${{ env.BRANCH_NAME }}" == "hotfix" ]]; then
-            IMAGE_TAG="hotfix"
-          else
-            IMAGE_TAG="latest"
-          fi
-
+          set -e
           az deployment group create \
             --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
             --template-file infra/main.bicep \
             --parameters \
-              solutionPrefix=${{ env.SOLUTION_PREFIX }} \
-              solutionLocation="${{ env.AZURE_LOCATION }}" \
-              azureOpenAILocation="${{ env.AZURE_LOCATION }}" \
-              modelDeploymentType="GlobalStandard" \
-              gptModelName="gpt-4o" \
-              gptModelVersion="2024-08-06" \
-              imageTag="${IMAGE_TAG}" \
-            --output json
-
-      - name: Extract Web App and API App URLs
-        id: get_output
-        run: |
-          WEBAPP_NAMES=$(az webapp list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --query "[].name" -o tsv)
-          for NAME in $WEBAPP_NAMES; do
-            if [[ $NAME == app-* ]]; then
-              WEBAPP_URL="https://${NAME}.azurewebsites.net"
-              echo "WEBAPP_URL=$WEBAPP_URL" >> $GITHUB_OUTPUT
-            fi
-          done
+              useWafAlignedArchitecture=true \
+              aiDeploymentsLocation='${{ env.AZURE_LOCATION }}' \
+              gptModelCapacity=5 \
+              virtualMachineConfiguration='{"adminUsername": "adminuser", "adminPassword": "P@ssw0rd1234"}' \
+              logAnalyticsWorkspaceConfiguration='{"existingWorkspaceResourceId": ""}'
 
-      - name: Get Container App Backend URL
-        id: get_backend_url
-        run: |
-          CONTAINER_APP_NAME=$(az containerapp list \
-            --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
-            --query "[0].name" -o tsv)
-
-          CONTAINER_APP_URL=$(az containerapp show \
-            --name "$CONTAINER_APP_NAME" \
-            --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
-            --query "properties.configuration.ingress.fqdn" -o tsv)
-
-          echo "CONTAINER_APP_URL=https://${CONTAINER_APP_URL}" >> $GITHUB_OUTPUT
-          echo "CONTAINER_APP=${CONTAINER_APP_NAME}" >> $GITHUB_OUTPUT
-
-      - name: Set Deployment Status
-        id: deployment_status
-        if: always()
+      - name: Send Notification on Failure
+        if: failure()
         run: |
-          if [ "${{ job.status }}" == "success" ]; then
-            echo "SUCCESS=true" >> $GITHUB_OUTPUT
-          else
-            echo "SUCCESS=false" >> $GITHUB_OUTPUT
-          fi
+          RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
 
-  e2e-test:
-    needs: deploy
-    if: needs.deploy.outputs.DEPLOYMENT_SUCCESS == 'true'
-    uses: ./.github/workflows/test-automation.yml
-    with:
-      MACAE_WEB_URL: ${{ needs.deploy.outputs.WEBAPP_URL }}
-      MACAE_URL_API: ${{ needs.deploy.outputs.API_APP_URL }}
-      MACAE_RG: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
-      MACAE_CONTAINER_APP: ${{ needs.deploy.outputs.CONTAINER_APP }}
-    secrets: inherit
-
-  cleanup-deployment:
-    if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
-    needs: [deploy, e2e-test]
-    runs-on: ubuntu-latest
-    env:
-      RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
-    steps:
-      - name: Setup Azure CLI
-        run: |
-          curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
-          az --version
-      - name: Login to Azure
-        run: |
-          az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
-          az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
+          # Construct the email body
+          EMAIL_BODY=$(cat <<EOF
+          {
+            "body": "<p>Dear Team,</p><p>We would like to inform you that the Multi-Agent-Custom-Automation-Engine-Solution-Accelerator Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Build URL:</strong> ${RUN_URL}<br> ${OUTPUT}</p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>"
+          }
+          EOF
+          )
 
-      - name: Extract AI Services and Key Vault Names
-        if: always()
-        run: |
-          echo "Fetching AI Services and Key Vault names before deletion..."
-
-          # Get Key Vault name
-          KEYVAULT_NAME=$(az resource list --resource-group "${{ env.RESOURCE_GROUP_NAME }}" --resource-type "Microsoft.KeyVault/vaults" --query "[].name" -o tsv)
-          echo "Detected Key Vault: $KEYVAULT_NAME"
-          echo "KEYVAULT_NAME=$KEYVAULT_NAME" >> $GITHUB_ENV
-          # Extract AI Services names
-          echo "Fetching AI Services..."
-          AI_SERVICES=$(az resource list --resource-group '${{ env.RESOURCE_GROUP_NAME }}' --resource-type "Microsoft.CognitiveServices/accounts" --query "[].name" -o tsv)
-          # Flatten newline-separated values to space-separated
-          AI_SERVICES=$(echo "$AI_SERVICES" | paste -sd ' ' -)
-          echo "Detected AI Services: $AI_SERVICES"
-          echo "AI_SERVICES=$AI_SERVICES" >> $GITHUB_ENV
+          # Send the notification
+          curl -X POST "${{ secrets.LOGIC_APP_URL }}" \
+            -H "Content-Type: application/json" \
+            -d "$EMAIL_BODY" || echo "Failed to send notification"
 
       - name: Get OpenAI Resource from Resource Group
         id: get_openai_resource
@@ -320,26 +227,3 @@ jobs:
           fi
 
           echo "Resource purging completed successfully"
-
-      - name: Send Notification on Failure
-        if: failure()
-        run: |
-          RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-
-          # Construct the email body
-          EMAIL_BODY=$(cat <<EOF
-          {
-            "body": "<p>Dear Team,</p><p>We would like to inform you that the Multi-Agent-Custom-Automation-Engine-Solution-Accelerator Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Build URL:</strong> ${RUN_URL}<br> ${OUTPUT}</p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>"
-          }
-          EOF
-          )
-
-          # Send the notification
-          curl -X POST "${{ secrets.LOGIC_APP_URL }}" \
-            -H "Content-Type: application/json" \
-            -d "$EMAIL_BODY" || echo "Failed to send notification"
-      - name: Logout from Azure
-        if: always()
-        run: |
-          az logout
-          echo "Logged out from Azure."
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index df9ab4a13..b35db605e 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -184,160 +184,160 @@ jobs:
       MACAE_CONTAINER_APP: ${{ needs.deploy.outputs.CONTAINER_APP }}
     secrets: inherit
 
-  # cleanup-deployment:
-  #   if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
-  #   needs: [deploy, e2e-test]
-  #   runs-on: ubuntu-latest
-  #   env:
-  #     RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
-  #   steps:
-  #     - name: Setup Azure CLI
-  #       run: |
-  #         curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
-  #         az --version
-  #     - name: Login to Azure
-  #       run: |
-  #         az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
-  #         az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
-
-  #     - name: Extract AI Services and Key Vault Names
-  #       if: always()
-  #       run: |
-  #         echo "Fetching AI Services and Key Vault names before deletion..."
-
-  #         # Get Key Vault name
-  #         KEYVAULT_NAME=$(az resource list --resource-group "${{ env.RESOURCE_GROUP_NAME }}" --resource-type "Microsoft.KeyVault/vaults" --query "[].name" -o tsv)
-  #         echo "Detected Key Vault: $KEYVAULT_NAME"
-  #         echo "KEYVAULT_NAME=$KEYVAULT_NAME" >> $GITHUB_ENV
-  #         # Extract AI Services names
-  #         echo "Fetching AI Services..."
-  #         AI_SERVICES=$(az resource list --resource-group '${{ env.RESOURCE_GROUP_NAME }}' --resource-type "Microsoft.CognitiveServices/accounts" --query "[].name" -o tsv)
-  #         # Flatten newline-separated values to space-separated
-  #         AI_SERVICES=$(echo "$AI_SERVICES" | paste -sd ' ' -)
-  #         echo "Detected AI Services: $AI_SERVICES"
-  #         echo "AI_SERVICES=$AI_SERVICES" >> $GITHUB_ENV
-
-  #     - name: Get OpenAI Resource from Resource Group
-  #       id: get_openai_resource
-  #       run: |
-
-  #         set -e
-  #         echo "Fetching OpenAI resource from resource group ${{ env.RESOURCE_GROUP_NAME }}..."
-
-  #         # Run the az resource list command to get the OpenAI resource name
-  #         openai_resource_name=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.CognitiveServices/accounts" --query "[0].name" -o tsv)
-
-  #         if [ -z "$openai_resource_name" ]; then
-  #           echo "No OpenAI resource found in resource group ${{ env.RESOURCE_GROUP_NAME }}."
-  #           exit 1
-  #         else
-  #           echo "OPENAI_RESOURCE_NAME=${openai_resource_name}" >> $GITHUB_ENV
-  #           echo "OpenAI resource name: ${openai_resource_name}"
-  #         fi
-
-  #     - name: Delete Bicep Deployment
-  #       if: always()
-  #       run: |
-  #         set -e
-  #         echo "Checking if resource group exists..."
-  #         rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
-  #         if [ "$rg_exists" = "true" ]; then
-  #           echo "Resource group exist. Cleaning..."
-  #           az group delete \
-  #               --name ${{ env.RESOURCE_GROUP_NAME }} \
-  #               --yes \
-  #               --no-wait
-  #           echo "Resource group deleted...  ${{ env.RESOURCE_GROUP_NAME }}"
-  #         else
-  #           echo "Resource group does not exists."
-  #         fi
-
-  #     - name: Wait for resource deletion to complete
-  #       run: |
-
-  #         # Add resources to the array
-  #         resources_to_check=("${{ env.OPENAI_RESOURCE_NAME }}")
-
-  #         echo "List of resources to check: ${resources_to_check[@]}"
-
-  #         # Maximum number of retries
-  #         max_retries=3
-
-  #         # Retry intervals in seconds (30, 60, 120)
-  #         retry_intervals=(30 60 120)
-
-  #         # Retry mechanism to check resources
-  #         retries=0
-  #         while true; do
-  #           resource_found=false
-
-  #           # Get the list of resources in YAML format again on each retry
-  #           resource_list=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --output yaml)
-
-  #           # Iterate through the resources to check
-  #           for resource in "${resources_to_check[@]}"; do
-  #             echo "Checking resource: $resource"
-  #             if echo "$resource_list" | grep -q "name: $resource"; then
-  #               echo "Resource '$resource' exists in the resource group."
-  #               resource_found=true
-  #             else
-  #               echo "Resource '$resource' does not exist in the resource group."
-  #             fi
-  #           done
-
-  #           # If any resource exists, retry
-  #           if [ "$resource_found" = true ]; then
-  #             retries=$((retries + 1))
-  #             if [ "$retries" -gt "$max_retries" ]; then
-  #               echo "Maximum retry attempts reached. Exiting."
-  #               break
-  #             else
-  #               # Wait for the appropriate interval for the current retry
-  #               echo "Waiting for ${retry_intervals[$retries-1]} seconds before retrying..."
-  #               sleep ${retry_intervals[$retries-1]}
-  #             fi
-  #           else
-  #             echo "No resources found. Exiting."
-  #             break
-  #           fi
-  #         done
-
-  #     - name: Purging the Resources
-  #       if: always()
-  #       run: |
-
-  #         set -e
-  #         echo "Azure OpenAI: ${{ env.OPENAI_RESOURCE_NAME }}"
-
-  #         # Purge OpenAI Resource
-  #         echo "Purging the OpenAI Resource..."
-  #         if ! az resource delete --ids /subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/providers/Microsoft.CognitiveServices/locations/eastus/resourceGroups/${{ env.RESOURCE_GROUP_NAME }}/deletedAccounts/${{ env.OPENAI_RESOURCE_NAME }} --verbose; then
-  #           echo "Failed to purge openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
-  #         else
-  #           echo "Purged the openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
-  #         fi
-
-  #         echo "Resource purging completed successfully"
-
-  #     - name: Send Notification on Failure
-  #       if: failure()
-  #       run: |
-  #         RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-
-  #         # Construct the email body
-  #         EMAIL_BODY=$(cat <<EOF
-  #         {
-  #           "body": "<p>Dear Team,</p><p>We would like to inform you that the Multi-Agent-Custom-Automation-Engine-Solution-Accelerator Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Build URL:</strong> ${RUN_URL}<br> ${OUTPUT}</p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>"
-  #         }
-  #         EOF
-  #         )
-
-  #         # Send the notification
-  #         curl -X POST "${{ secrets.LOGIC_APP_URL }}" \
-  #           -H "Content-Type: application/json" \
-  #           -d "$EMAIL_BODY" || echo "Failed to send notification"
-  #     - name: Logout from Azure
-  #       if: always()
-  #       run: |
-  #         az logout
-  #         echo "Logged out from Azure."
+  cleanup-deployment:
+    if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
+    needs: [deploy, e2e-test]
+    runs-on: ubuntu-latest
+    env:
+      RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
+    steps:
+      - name: Setup Azure CLI
+        run: |
+          curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
+          az --version
+      - name: Login to Azure
+        run: |
+          az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
+          az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
+
+      - name: Extract AI Services and Key Vault Names
+        if: always()
+        run: |
+          echo "Fetching AI Services and Key Vault names before deletion..."
+
+          # Get Key Vault name
+          KEYVAULT_NAME=$(az resource list --resource-group "${{ env.RESOURCE_GROUP_NAME }}" --resource-type "Microsoft.KeyVault/vaults" --query "[].name" -o tsv)
+          echo "Detected Key Vault: $KEYVAULT_NAME"
+          echo "KEYVAULT_NAME=$KEYVAULT_NAME" >> $GITHUB_ENV
+          # Extract AI Services names
+          echo "Fetching AI Services..."
+          AI_SERVICES=$(az resource list --resource-group '${{ env.RESOURCE_GROUP_NAME }}' --resource-type "Microsoft.CognitiveServices/accounts" --query "[].name" -o tsv)
+          # Flatten newline-separated values to space-separated
+          AI_SERVICES=$(echo "$AI_SERVICES" | paste -sd ' ' -)
+          echo "Detected AI Services: $AI_SERVICES"
+          echo "AI_SERVICES=$AI_SERVICES" >> $GITHUB_ENV
+
+      - name: Get OpenAI Resource from Resource Group
+        id: get_openai_resource
+        run: |
+
+          set -e
+          echo "Fetching OpenAI resource from resource group ${{ env.RESOURCE_GROUP_NAME }}..."
+
+          # Run the az resource list command to get the OpenAI resource name
+          openai_resource_name=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.CognitiveServices/accounts" --query "[0].name" -o tsv)
+
+          if [ -z "$openai_resource_name" ]; then
+            echo "No OpenAI resource found in resource group ${{ env.RESOURCE_GROUP_NAME }}."
+            exit 1
+          else
+            echo "OPENAI_RESOURCE_NAME=${openai_resource_name}" >> $GITHUB_ENV
+            echo "OpenAI resource name: ${openai_resource_name}"
+          fi
+
+      - name: Delete Bicep Deployment
+        if: always()
+        run: |
+          set -e
+          echo "Checking if resource group exists..."
+          rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
+          if [ "$rg_exists" = "true" ]; then
+            echo "Resource group exist. Cleaning..."
+            az group delete \
+                --name ${{ env.RESOURCE_GROUP_NAME }} \
+                --yes \
+                --no-wait
+            echo "Resource group deleted...  ${{ env.RESOURCE_GROUP_NAME }}"
+          else
+            echo "Resource group does not exists."
+          fi
+
+      - name: Wait for resource deletion to complete
+        run: |
+
+          # Add resources to the array
+          resources_to_check=("${{ env.OPENAI_RESOURCE_NAME }}")
+
+          echo "List of resources to check: ${resources_to_check[@]}"
+
+          # Maximum number of retries
+          max_retries=3
+
+          # Retry intervals in seconds (30, 60, 120)
+          retry_intervals=(30 60 120)
+
+          # Retry mechanism to check resources
+          retries=0
+          while true; do
+            resource_found=false
+
+            # Get the list of resources in YAML format again on each retry
+            resource_list=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --output yaml)
+
+            # Iterate through the resources to check
+            for resource in "${resources_to_check[@]}"; do
+              echo "Checking resource: $resource"
+              if echo "$resource_list" | grep -q "name: $resource"; then
+                echo "Resource '$resource' exists in the resource group."
+                resource_found=true
+              else
+                echo "Resource '$resource' does not exist in the resource group."
+              fi
+            done
+
+            # If any resource exists, retry
+            if [ "$resource_found" = true ]; then
+              retries=$((retries + 1))
+              if [ "$retries" -gt "$max_retries" ]; then
+                echo "Maximum retry attempts reached. Exiting."
+                break
+              else
+                # Wait for the appropriate interval for the current retry
+                echo "Waiting for ${retry_intervals[$retries-1]} seconds before retrying..."
+                sleep ${retry_intervals[$retries-1]}
+              fi
+            else
+              echo "No resources found. Exiting."
+              break
+            fi
+          done
+
+      - name: Purging the Resources
+        if: always()
+        run: |
+
+          set -e
+          echo "Azure OpenAI: ${{ env.OPENAI_RESOURCE_NAME }}"
+
+          # Purge OpenAI Resource
+          echo "Purging the OpenAI Resource..."
+          if ! az resource delete --ids /subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/providers/Microsoft.CognitiveServices/locations/eastus/resourceGroups/${{ env.RESOURCE_GROUP_NAME }}/deletedAccounts/${{ env.OPENAI_RESOURCE_NAME }} --verbose; then
+            echo "Failed to purge openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
+          else
+            echo "Purged the openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
+          fi
+
+          echo "Resource purging completed successfully"
+
+      - name: Send Notification on Failure
+        if: failure()
+        run: |
+          RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
+          # Construct the email body
+          EMAIL_BODY=$(cat <<EOF
+          {
+            "body": "<p>Dear Team,</p><p>We would like to inform you that the Multi-Agent-Custom-Automation-Engine-Solution-Accelerator Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Build URL:</strong> ${RUN_URL}<br> ${OUTPUT}</p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>"
+          }
+          EOF
+          )
+
+          # Send the notification
+          curl -X POST "${{ secrets.LOGIC_APP_URL }}" \
+            -H "Content-Type: application/json" \
+            -d "$EMAIL_BODY" || echo "Failed to send notification"
+      - name: Logout from Azure
+        if: always()
+        run: |
+          az logout
+          echo "Logged out from Azure."

From 566900010aec786d5a3b31e6dd98944d61d6d6ca Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Fri, 11 Jul 2025 11:23:26 +0530
Subject: [PATCH 57/70] edit

---
 .github/workflows/deploy.yml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 1a602e8bf..185350d9c 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -118,8 +118,8 @@ jobs:
         run: |
           if [[ "${{ env.BRANCH_NAME }}" == "main" ]]; then
             IMAGE_TAG="latest"
-          elif [[ "${{ env.BRANCH_NAME }}" == "hotfix" ]]; then
-            IMAGE_TAG="hotfix"
+          elif [[ "${{ env.BRANCH_NAME }}" == "dev" ]]; then
+            IMAGE_TAG="dev"
           else
             IMAGE_TAG="latest"
           fi
@@ -142,7 +142,7 @@ jobs:
               logAnalyticsWorkspaceConfiguration='{"dataRetentionInDays": 30, "existingWorkspaceResourceId": ""}' \
               applicationInsightsConfiguration='{"retentionInDays": 30}' \
               virtualNetworkConfiguration='{"enabled": false}' \
-              webServerFarmConfiguration='{"skuCapacity": 1, "skuName": "B2"}'
+              webServerFarmConfiguration='{"skuCapacity": 1, "skuName": "B2"}' \
             --output json
 
       - name: Extract Web App and API App URLs
@@ -156,7 +156,6 @@ jobs:
             fi
           done
 
-
       - name: Get Container App Backend URL
         id: get_backend_url
         run: |

From c6e3806d85ed7ef6f4ef0adb91ca3baa13fc48ab Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Fri, 11 Jul 2025 11:35:16 +0530
Subject: [PATCH 58/70] edit

---
 .github/workflows/deploy.yml          |  2 ++
 .github/workflows/test-automation.yml | 37 ++++++++++-----------------
 2 files changed, 16 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 185350d9c..a6fa11737 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -120,6 +120,8 @@ jobs:
             IMAGE_TAG="latest"
           elif [[ "${{ env.BRANCH_NAME }}" == "dev" ]]; then
             IMAGE_TAG="dev"
+          elif [[ "${{ env.BRANCH_NAME }}" == "hotfix" ]]; then
+            IMAGE_TAG="hotfix"
           else
             IMAGE_TAG="latest"
           fi
diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index 7ed7df8b7..edc99527e 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -1,15 +1,6 @@
 name: Test Automation MACAE
 
 on:
-  push:
-    branches:
-      - main
-      - dev
-      - hotfix
-    paths:
-      - "tests/e2e-test/**"
-  schedule:
-    - cron: "0 13 * * *"
   workflow_dispatch:
   workflow_call:
     inputs:
@@ -56,12 +47,12 @@ jobs:
         with:
           creds: '{"clientId":"${{ secrets.AZURE_CLIENT_ID }}","clientSecret":"${{ secrets.AZURE_CLIENT_SECRET }}","subscriptionId":"${{ secrets.AZURE_SUBSCRIPTION_ID }}","tenantId":"${{ secrets.AZURE_TENANT_ID }}"}'
 
-      - name: Start Container App
-        uses: azure/cli@v2
-        with:
-          azcliversion: "latest"
-          inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/start?api-version=2025-01-01"
+      # - name: Start Container App
+      #   uses: azure/cli@v2
+      #   with:
+      #     azcliversion: "latest"
+      #     inlineScript: |
+      #       az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/start?api-version=2025-01-01"
 
       - name: Install dependencies
         run: |
@@ -188,11 +179,11 @@ jobs:
             -H "Content-Type: application/json" \
             -d "$EMAIL_BODY" || echo "Failed to send notification"
 
-      - name: Stop Container App
-        if: always()
-        uses: azure/cli@v2
-        with:
-          azcliversion: "latest"
-          inlineScript: |
-            az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/stop?api-version=2025-01-01"
-            az logout
+      # - name: Stop Container App
+      #   if: always()
+      #   uses: azure/cli@v2
+      #   with:
+      #     azcliversion: "latest"
+      #     inlineScript: |
+      #       az rest -m post -u "/subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/resourceGroups/${{ env.MACAE_RG }}/providers/Microsoft.App/containerApps/${{ env.MACAE_CONTAINER_APP }}/stop?api-version=2025-01-01"
+      #       az logout

From 4ef14b139fd60b7614e3dd11ce06563dc73b2799 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Fri, 11 Jul 2025 11:41:02 +0530
Subject: [PATCH 59/70] edit

---
 .github/workflows/deploy.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index a6fa11737..34bbe6c54 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -118,8 +118,6 @@ jobs:
         run: |
           if [[ "${{ env.BRANCH_NAME }}" == "main" ]]; then
             IMAGE_TAG="latest"
-          elif [[ "${{ env.BRANCH_NAME }}" == "dev" ]]; then
-            IMAGE_TAG="dev"
           elif [[ "${{ env.BRANCH_NAME }}" == "hotfix" ]]; then
             IMAGE_TAG="hotfix"
           else

From 4c2c0adaf7c8488cdf72d3e4c1ae6456d00be7b5 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Fri, 11 Jul 2025 11:44:57 +0530
Subject: [PATCH 60/70] edit

---
 .github/workflows/deploy.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 34bbe6c54..7e73dee5d 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -128,7 +128,6 @@ jobs:
             --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
             --template-file infra/main.bicep \
             --parameters \
-
               solutionPrefix=${{ env.SOLUTION_PREFIX }} \
               solutionLocation="${{ env.AZURE_LOCATION }}" \
               azureOpenAILocation="${{ env.AZURE_LOCATION }}" \

From cd29617b1f0a3cab73771c401307fb743bb1a5b8 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Fri, 11 Jul 2025 11:49:00 +0530
Subject: [PATCH 61/70] edit

---
 .github/workflows/deploy.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 7e73dee5d..b3e2bfff5 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -130,7 +130,6 @@ jobs:
             --parameters \
               solutionPrefix=${{ env.SOLUTION_PREFIX }} \
               solutionLocation="${{ env.AZURE_LOCATION }}" \
-              azureOpenAILocation="${{ env.AZURE_LOCATION }}" \
               modelDeploymentType="GlobalStandard" \
               gptModelName="gpt-4o" \
               gptModelVersion="2024-08-06" \

From c8fd0e52547e514ecd91774c91d18978b375a815 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Fri, 11 Jul 2025 12:21:30 +0530
Subject: [PATCH 62/70] edit

---
 .github/workflows/deploy.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index b3e2bfff5..420356f08 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -118,6 +118,8 @@ jobs:
         run: |
           if [[ "${{ env.BRANCH_NAME }}" == "main" ]]; then
             IMAGE_TAG="latest"
+          elif [[ "${{ env.BRANCH_NAME }}" == "dev" ]]; then
+            IMAGE_TAG="dev"
           elif [[ "${{ env.BRANCH_NAME }}" == "hotfix" ]]; then
             IMAGE_TAG="hotfix"
           else
@@ -235,7 +237,7 @@ jobs:
 
           if [ -z "$openai_resource_name" ]; then
             echo "No OpenAI resource found in resource group ${{ env.RESOURCE_GROUP_NAME }}."
-            exit 1
+            exit 0
           else
             echo "OPENAI_RESOURCE_NAME=${openai_resource_name}" >> $GITHUB_ENV
             echo "OpenAI resource name: ${openai_resource_name}"

From e4fb178cd519fd6ab2de40b9b94b63fc2015ff04 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Fri, 11 Jul 2025 12:25:28 +0530
Subject: [PATCH 63/70] edit

---
 .github/workflows/deploy.yml | 314 +++++++++++++++++------------------
 1 file changed, 157 insertions(+), 157 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 420356f08..0385692d2 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -192,160 +192,160 @@ jobs:
       MACAE_CONTAINER_APP: ${{ needs.deploy.outputs.CONTAINER_APP }}
     secrets: inherit
 
-  cleanup-deployment:
-    if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
-    needs: [deploy, e2e-test]
-    runs-on: ubuntu-latest
-    env:
-      RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
-    steps:
-      - name: Setup Azure CLI
-        run: |
-          curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
-          az --version
-      - name: Login to Azure
-        run: |
-          az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
-          az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
-
-      - name: Extract AI Services and Key Vault Names
-        if: always()
-        run: |
-          echo "Fetching AI Services and Key Vault names before deletion..."
-
-          # Get Key Vault name
-          KEYVAULT_NAME=$(az resource list --resource-group "${{ env.RESOURCE_GROUP_NAME }}" --resource-type "Microsoft.KeyVault/vaults" --query "[].name" -o tsv)
-          echo "Detected Key Vault: $KEYVAULT_NAME"
-          echo "KEYVAULT_NAME=$KEYVAULT_NAME" >> $GITHUB_ENV
-          # Extract AI Services names
-          echo "Fetching AI Services..."
-          AI_SERVICES=$(az resource list --resource-group '${{ env.RESOURCE_GROUP_NAME }}' --resource-type "Microsoft.CognitiveServices/accounts" --query "[].name" -o tsv)
-          # Flatten newline-separated values to space-separated
-          AI_SERVICES=$(echo "$AI_SERVICES" | paste -sd ' ' -)
-          echo "Detected AI Services: $AI_SERVICES"
-          echo "AI_SERVICES=$AI_SERVICES" >> $GITHUB_ENV
-
-      - name: Get OpenAI Resource from Resource Group
-        id: get_openai_resource
-        run: |
-
-          set -e
-          echo "Fetching OpenAI resource from resource group ${{ env.RESOURCE_GROUP_NAME }}..."
-
-          # Run the az resource list command to get the OpenAI resource name
-          openai_resource_name=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.CognitiveServices/accounts" --query "[0].name" -o tsv)
-
-          if [ -z "$openai_resource_name" ]; then
-            echo "No OpenAI resource found in resource group ${{ env.RESOURCE_GROUP_NAME }}."
-            exit 0
-          else
-            echo "OPENAI_RESOURCE_NAME=${openai_resource_name}" >> $GITHUB_ENV
-            echo "OpenAI resource name: ${openai_resource_name}"
-          fi
-
-      - name: Delete Bicep Deployment
-        if: always()
-        run: |
-          set -e
-          echo "Checking if resource group exists..."
-          rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
-          if [ "$rg_exists" = "true" ]; then
-            echo "Resource group exist. Cleaning..."
-            az group delete \
-                --name ${{ env.RESOURCE_GROUP_NAME }} \
-                --yes \
-                --no-wait
-            echo "Resource group deleted...  ${{ env.RESOURCE_GROUP_NAME }}"
-          else
-            echo "Resource group does not exists."
-          fi
-
-      - name: Wait for resource deletion to complete
-        run: |
-
-          # Add resources to the array
-          resources_to_check=("${{ env.OPENAI_RESOURCE_NAME }}")
-
-          echo "List of resources to check: ${resources_to_check[@]}"
-
-          # Maximum number of retries
-          max_retries=3
-
-          # Retry intervals in seconds (30, 60, 120)
-          retry_intervals=(30 60 120)
-
-          # Retry mechanism to check resources
-          retries=0
-          while true; do
-            resource_found=false
-
-            # Get the list of resources in YAML format again on each retry
-            resource_list=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --output yaml)
-
-            # Iterate through the resources to check
-            for resource in "${resources_to_check[@]}"; do
-              echo "Checking resource: $resource"
-              if echo "$resource_list" | grep -q "name: $resource"; then
-                echo "Resource '$resource' exists in the resource group."
-                resource_found=true
-              else
-                echo "Resource '$resource' does not exist in the resource group."
-              fi
-            done
-
-            # If any resource exists, retry
-            if [ "$resource_found" = true ]; then
-              retries=$((retries + 1))
-              if [ "$retries" -gt "$max_retries" ]; then
-                echo "Maximum retry attempts reached. Exiting."
-                break
-              else
-                # Wait for the appropriate interval for the current retry
-                echo "Waiting for ${retry_intervals[$retries-1]} seconds before retrying..."
-                sleep ${retry_intervals[$retries-1]}
-              fi
-            else
-              echo "No resources found. Exiting."
-              break
-            fi
-          done
-
-      - name: Purging the Resources
-        if: always()
-        run: |
-
-          set -e
-          echo "Azure OpenAI: ${{ env.OPENAI_RESOURCE_NAME }}"
-
-          # Purge OpenAI Resource
-          echo "Purging the OpenAI Resource..."
-          if ! az resource delete --ids /subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/providers/Microsoft.CognitiveServices/locations/eastus/resourceGroups/${{ env.RESOURCE_GROUP_NAME }}/deletedAccounts/${{ env.OPENAI_RESOURCE_NAME }} --verbose; then
-            echo "Failed to purge openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
-          else
-            echo "Purged the openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
-          fi
-
-          echo "Resource purging completed successfully"
-
-      - name: Send Notification on Failure
-        if: failure()
-        run: |
-          RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-
-          # Construct the email body
-          EMAIL_BODY=$(cat <<EOF
-          {
-            "body": "<p>Dear Team,</p><p>We would like to inform you that the Multi-Agent-Custom-Automation-Engine-Solution-Accelerator Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Build URL:</strong> ${RUN_URL}<br> ${OUTPUT}</p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>"
-          }
-          EOF
-          )
-
-          # Send the notification
-          curl -X POST "${{ secrets.LOGIC_APP_URL }}" \
-            -H "Content-Type: application/json" \
-            -d "$EMAIL_BODY" || echo "Failed to send notification"
-      - name: Logout from Azure
-        if: always()
-        run: |
-          az logout
-          echo "Logged out from Azure."
+  # cleanup-deployment:
+  #   if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
+  #   needs: [deploy, e2e-test]
+  #   runs-on: ubuntu-latest
+  #   env:
+  #     RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
+  #   steps:
+  #     - name: Setup Azure CLI
+  #       run: |
+  #         curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
+  #         az --version
+  #     - name: Login to Azure
+  #       run: |
+  #         az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
+  #         az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
+
+  #     - name: Extract AI Services and Key Vault Names
+  #       if: always()
+  #       run: |
+  #         echo "Fetching AI Services and Key Vault names before deletion..."
+
+  #         # Get Key Vault name
+  #         KEYVAULT_NAME=$(az resource list --resource-group "${{ env.RESOURCE_GROUP_NAME }}" --resource-type "Microsoft.KeyVault/vaults" --query "[].name" -o tsv)
+  #         echo "Detected Key Vault: $KEYVAULT_NAME"
+  #         echo "KEYVAULT_NAME=$KEYVAULT_NAME" >> $GITHUB_ENV
+  #         # Extract AI Services names
+  #         echo "Fetching AI Services..."
+  #         AI_SERVICES=$(az resource list --resource-group '${{ env.RESOURCE_GROUP_NAME }}' --resource-type "Microsoft.CognitiveServices/accounts" --query "[].name" -o tsv)
+  #         # Flatten newline-separated values to space-separated
+  #         AI_SERVICES=$(echo "$AI_SERVICES" | paste -sd ' ' -)
+  #         echo "Detected AI Services: $AI_SERVICES"
+  #         echo "AI_SERVICES=$AI_SERVICES" >> $GITHUB_ENV
+
+  #     - name: Get OpenAI Resource from Resource Group
+  #       id: get_openai_resource
+  #       run: |
+
+  #         set -e
+  #         echo "Fetching OpenAI resource from resource group ${{ env.RESOURCE_GROUP_NAME }}..."
+
+  #         # Run the az resource list command to get the OpenAI resource name
+  #         openai_resource_name=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.CognitiveServices/accounts" --query "[0].name" -o tsv)
+
+  #         if [ -z "$openai_resource_name" ]; then
+  #           echo "No OpenAI resource found in resource group ${{ env.RESOURCE_GROUP_NAME }}."
+  #           exit 0
+  #         else
+  #           echo "OPENAI_RESOURCE_NAME=${openai_resource_name}" >> $GITHUB_ENV
+  #           echo "OpenAI resource name: ${openai_resource_name}"
+  #         fi
+
+  #     - name: Delete Bicep Deployment
+  #       if: always()
+  #       run: |
+  #         set -e
+  #         echo "Checking if resource group exists..."
+  #         rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
+  #         if [ "$rg_exists" = "true" ]; then
+  #           echo "Resource group exist. Cleaning..."
+  #           az group delete \
+  #               --name ${{ env.RESOURCE_GROUP_NAME }} \
+  #               --yes \
+  #               --no-wait
+  #           echo "Resource group deleted...  ${{ env.RESOURCE_GROUP_NAME }}"
+  #         else
+  #           echo "Resource group does not exists."
+  #         fi
+
+  #     - name: Wait for resource deletion to complete
+  #       run: |
+
+  #         # Add resources to the array
+  #         resources_to_check=("${{ env.OPENAI_RESOURCE_NAME }}")
+
+  #         echo "List of resources to check: ${resources_to_check[@]}"
+
+  #         # Maximum number of retries
+  #         max_retries=3
+
+  #         # Retry intervals in seconds (30, 60, 120)
+  #         retry_intervals=(30 60 120)
+
+  #         # Retry mechanism to check resources
+  #         retries=0
+  #         while true; do
+  #           resource_found=false
+
+  #           # Get the list of resources in YAML format again on each retry
+  #           resource_list=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --output yaml)
+
+  #           # Iterate through the resources to check
+  #           for resource in "${resources_to_check[@]}"; do
+  #             echo "Checking resource: $resource"
+  #             if echo "$resource_list" | grep -q "name: $resource"; then
+  #               echo "Resource '$resource' exists in the resource group."
+  #               resource_found=true
+  #             else
+  #               echo "Resource '$resource' does not exist in the resource group."
+  #             fi
+  #           done
+
+  #           # If any resource exists, retry
+  #           if [ "$resource_found" = true ]; then
+  #             retries=$((retries + 1))
+  #             if [ "$retries" -gt "$max_retries" ]; then
+  #               echo "Maximum retry attempts reached. Exiting."
+  #               break
+  #             else
+  #               # Wait for the appropriate interval for the current retry
+  #               echo "Waiting for ${retry_intervals[$retries-1]} seconds before retrying..."
+  #               sleep ${retry_intervals[$retries-1]}
+  #             fi
+  #           else
+  #             echo "No resources found. Exiting."
+  #             break
+  #           fi
+  #         done
+
+  #     - name: Purging the Resources
+  #       if: always()
+  #       run: |
+
+  #         set -e
+  #         echo "Azure OpenAI: ${{ env.OPENAI_RESOURCE_NAME }}"
+
+  #         # Purge OpenAI Resource
+  #         echo "Purging the OpenAI Resource..."
+  #         if ! az resource delete --ids /subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/providers/Microsoft.CognitiveServices/locations/eastus/resourceGroups/${{ env.RESOURCE_GROUP_NAME }}/deletedAccounts/${{ env.OPENAI_RESOURCE_NAME }} --verbose; then
+  #           echo "Failed to purge openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
+  #         else
+  #           echo "Purged the openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
+  #         fi
+
+  #         echo "Resource purging completed successfully"
+
+  #     - name: Send Notification on Failure
+  #       if: failure()
+  #       run: |
+  #         RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
+  #         # Construct the email body
+  #         EMAIL_BODY=$(cat <<EOF
+  #         {
+  #           "body": "<p>Dear Team,</p><p>We would like to inform you that the Multi-Agent-Custom-Automation-Engine-Solution-Accelerator Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Build URL:</strong> ${RUN_URL}<br> ${OUTPUT}</p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>"
+  #         }
+  #         EOF
+  #         )
+
+  #         # Send the notification
+  #         curl -X POST "${{ secrets.LOGIC_APP_URL }}" \
+  #           -H "Content-Type: application/json" \
+  #           -d "$EMAIL_BODY" || echo "Failed to send notification"
+  #     - name: Logout from Azure
+  #       if: always()
+  #       run: |
+  #         az logout
+  #         echo "Logged out from Azure."

From ee20734a46fc5b1efeac325de307bf48a5a42c10 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Fri, 11 Jul 2025 12:30:33 +0530
Subject: [PATCH 64/70] edit

---
 .github/workflows/deploy.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 0385692d2..6a928e398 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -14,7 +14,7 @@ on:
     - cron: "0 11,23 * * *" # Runs at 11:00 AM and 11:00 PM GMT
   workflow_dispatch: #Allow manual triggering
 env:
-  GPT_MIN_CAPACITY: 140
+  GPT_MIN_CAPACITY: 150
   BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
 
 jobs:
@@ -37,7 +37,7 @@ jobs:
           export AZURE_TENANT_ID=${{ secrets.AZURE_TENANT_ID }}
           export AZURE_CLIENT_SECRET=${{ secrets.AZURE_CLIENT_SECRET }}
           export AZURE_SUBSCRIPTION_ID="${{ secrets.AZURE_SUBSCRIPTION_ID }}"
-          export GPT_MIN_CAPACITY="5"
+          export GPT_MIN_CAPACITY="150"
           export AZURE_REGIONS="${{ vars.AZURE_REGIONS }}"
 
           chmod +x infra/scripts/checkquota.sh
@@ -138,7 +138,7 @@ jobs:
               imageTag="${IMAGE_TAG}" \
               useWafAlignedArchitecture=false \
               aiDeploymentsLocation='${{ env.AZURE_LOCATION }}' \
-              gptModelCapacity=5 \
+              gptModelCapacity=150 \
               logAnalyticsWorkspaceConfiguration='{"dataRetentionInDays": 30, "existingWorkspaceResourceId": ""}' \
               applicationInsightsConfiguration='{"retentionInDays": 30}' \
               virtualNetworkConfiguration='{"enabled": false}' \

From 1629f8941c93e5014db52a8169ddbc4e3e167a66 Mon Sep 17 00:00:00 2001
From: "Kanchan Nagshetti (Persistent Systems Inc)"
 <v-knagshetti@microsoft.com>
Date: Fri, 11 Jul 2025 12:47:05 +0530
Subject: [PATCH 65/70] edit

---
 .github/workflows/deploy.yml | 314 +++++++++++++++++------------------
 1 file changed, 157 insertions(+), 157 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 6a928e398..c8e5b6c97 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -192,160 +192,160 @@ jobs:
       MACAE_CONTAINER_APP: ${{ needs.deploy.outputs.CONTAINER_APP }}
     secrets: inherit
 
-  # cleanup-deployment:
-  #   if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
-  #   needs: [deploy, e2e-test]
-  #   runs-on: ubuntu-latest
-  #   env:
-  #     RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
-  #   steps:
-  #     - name: Setup Azure CLI
-  #       run: |
-  #         curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
-  #         az --version
-  #     - name: Login to Azure
-  #       run: |
-  #         az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
-  #         az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
-
-  #     - name: Extract AI Services and Key Vault Names
-  #       if: always()
-  #       run: |
-  #         echo "Fetching AI Services and Key Vault names before deletion..."
-
-  #         # Get Key Vault name
-  #         KEYVAULT_NAME=$(az resource list --resource-group "${{ env.RESOURCE_GROUP_NAME }}" --resource-type "Microsoft.KeyVault/vaults" --query "[].name" -o tsv)
-  #         echo "Detected Key Vault: $KEYVAULT_NAME"
-  #         echo "KEYVAULT_NAME=$KEYVAULT_NAME" >> $GITHUB_ENV
-  #         # Extract AI Services names
-  #         echo "Fetching AI Services..."
-  #         AI_SERVICES=$(az resource list --resource-group '${{ env.RESOURCE_GROUP_NAME }}' --resource-type "Microsoft.CognitiveServices/accounts" --query "[].name" -o tsv)
-  #         # Flatten newline-separated values to space-separated
-  #         AI_SERVICES=$(echo "$AI_SERVICES" | paste -sd ' ' -)
-  #         echo "Detected AI Services: $AI_SERVICES"
-  #         echo "AI_SERVICES=$AI_SERVICES" >> $GITHUB_ENV
-
-  #     - name: Get OpenAI Resource from Resource Group
-  #       id: get_openai_resource
-  #       run: |
-
-  #         set -e
-  #         echo "Fetching OpenAI resource from resource group ${{ env.RESOURCE_GROUP_NAME }}..."
-
-  #         # Run the az resource list command to get the OpenAI resource name
-  #         openai_resource_name=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.CognitiveServices/accounts" --query "[0].name" -o tsv)
-
-  #         if [ -z "$openai_resource_name" ]; then
-  #           echo "No OpenAI resource found in resource group ${{ env.RESOURCE_GROUP_NAME }}."
-  #           exit 0
-  #         else
-  #           echo "OPENAI_RESOURCE_NAME=${openai_resource_name}" >> $GITHUB_ENV
-  #           echo "OpenAI resource name: ${openai_resource_name}"
-  #         fi
-
-  #     - name: Delete Bicep Deployment
-  #       if: always()
-  #       run: |
-  #         set -e
-  #         echo "Checking if resource group exists..."
-  #         rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
-  #         if [ "$rg_exists" = "true" ]; then
-  #           echo "Resource group exist. Cleaning..."
-  #           az group delete \
-  #               --name ${{ env.RESOURCE_GROUP_NAME }} \
-  #               --yes \
-  #               --no-wait
-  #           echo "Resource group deleted...  ${{ env.RESOURCE_GROUP_NAME }}"
-  #         else
-  #           echo "Resource group does not exists."
-  #         fi
-
-  #     - name: Wait for resource deletion to complete
-  #       run: |
-
-  #         # Add resources to the array
-  #         resources_to_check=("${{ env.OPENAI_RESOURCE_NAME }}")
-
-  #         echo "List of resources to check: ${resources_to_check[@]}"
-
-  #         # Maximum number of retries
-  #         max_retries=3
-
-  #         # Retry intervals in seconds (30, 60, 120)
-  #         retry_intervals=(30 60 120)
-
-  #         # Retry mechanism to check resources
-  #         retries=0
-  #         while true; do
-  #           resource_found=false
-
-  #           # Get the list of resources in YAML format again on each retry
-  #           resource_list=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --output yaml)
-
-  #           # Iterate through the resources to check
-  #           for resource in "${resources_to_check[@]}"; do
-  #             echo "Checking resource: $resource"
-  #             if echo "$resource_list" | grep -q "name: $resource"; then
-  #               echo "Resource '$resource' exists in the resource group."
-  #               resource_found=true
-  #             else
-  #               echo "Resource '$resource' does not exist in the resource group."
-  #             fi
-  #           done
-
-  #           # If any resource exists, retry
-  #           if [ "$resource_found" = true ]; then
-  #             retries=$((retries + 1))
-  #             if [ "$retries" -gt "$max_retries" ]; then
-  #               echo "Maximum retry attempts reached. Exiting."
-  #               break
-  #             else
-  #               # Wait for the appropriate interval for the current retry
-  #               echo "Waiting for ${retry_intervals[$retries-1]} seconds before retrying..."
-  #               sleep ${retry_intervals[$retries-1]}
-  #             fi
-  #           else
-  #             echo "No resources found. Exiting."
-  #             break
-  #           fi
-  #         done
-
-  #     - name: Purging the Resources
-  #       if: always()
-  #       run: |
-
-  #         set -e
-  #         echo "Azure OpenAI: ${{ env.OPENAI_RESOURCE_NAME }}"
-
-  #         # Purge OpenAI Resource
-  #         echo "Purging the OpenAI Resource..."
-  #         if ! az resource delete --ids /subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/providers/Microsoft.CognitiveServices/locations/eastus/resourceGroups/${{ env.RESOURCE_GROUP_NAME }}/deletedAccounts/${{ env.OPENAI_RESOURCE_NAME }} --verbose; then
-  #           echo "Failed to purge openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
-  #         else
-  #           echo "Purged the openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
-  #         fi
-
-  #         echo "Resource purging completed successfully"
-
-  #     - name: Send Notification on Failure
-  #       if: failure()
-  #       run: |
-  #         RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-
-  #         # Construct the email body
-  #         EMAIL_BODY=$(cat <<EOF
-  #         {
-  #           "body": "<p>Dear Team,</p><p>We would like to inform you that the Multi-Agent-Custom-Automation-Engine-Solution-Accelerator Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Build URL:</strong> ${RUN_URL}<br> ${OUTPUT}</p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>"
-  #         }
-  #         EOF
-  #         )
-
-  #         # Send the notification
-  #         curl -X POST "${{ secrets.LOGIC_APP_URL }}" \
-  #           -H "Content-Type: application/json" \
-  #           -d "$EMAIL_BODY" || echo "Failed to send notification"
-  #     - name: Logout from Azure
-  #       if: always()
-  #       run: |
-  #         az logout
-  #         echo "Logged out from Azure."
+  cleanup-deployment:
+    if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
+    needs: [deploy, e2e-test]
+    runs-on: ubuntu-latest
+    env:
+      RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
+    steps:
+      - name: Setup Azure CLI
+        run: |
+          curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
+          az --version
+      - name: Login to Azure
+        run: |
+          az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
+          az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
+
+      - name: Extract AI Services and Key Vault Names
+        if: always()
+        run: |
+          echo "Fetching AI Services and Key Vault names before deletion..."
+
+          # Get Key Vault name
+          KEYVAULT_NAME=$(az resource list --resource-group "${{ env.RESOURCE_GROUP_NAME }}" --resource-type "Microsoft.KeyVault/vaults" --query "[].name" -o tsv)
+          echo "Detected Key Vault: $KEYVAULT_NAME"
+          echo "KEYVAULT_NAME=$KEYVAULT_NAME" >> $GITHUB_ENV
+          # Extract AI Services names
+          echo "Fetching AI Services..."
+          AI_SERVICES=$(az resource list --resource-group '${{ env.RESOURCE_GROUP_NAME }}' --resource-type "Microsoft.CognitiveServices/accounts" --query "[].name" -o tsv)
+          # Flatten newline-separated values to space-separated
+          AI_SERVICES=$(echo "$AI_SERVICES" | paste -sd ' ' -)
+          echo "Detected AI Services: $AI_SERVICES"
+          echo "AI_SERVICES=$AI_SERVICES" >> $GITHUB_ENV
+
+      - name: Get OpenAI Resource from Resource Group
+        id: get_openai_resource
+        run: |
+
+          set -e
+          echo "Fetching OpenAI resource from resource group ${{ env.RESOURCE_GROUP_NAME }}..."
+
+          # Run the az resource list command to get the OpenAI resource name
+          openai_resource_name=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.CognitiveServices/accounts" --query "[0].name" -o tsv)
+
+          if [ -z "$openai_resource_name" ]; then
+            echo "No OpenAI resource found in resource group ${{ env.RESOURCE_GROUP_NAME }}."
+            exit 0
+          else
+            echo "OPENAI_RESOURCE_NAME=${openai_resource_name}" >> $GITHUB_ENV
+            echo "OpenAI resource name: ${openai_resource_name}"
+          fi
+
+      - name: Delete Bicep Deployment
+        if: always()
+        run: |
+          set -e
+          echo "Checking if resource group exists..."
+          rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
+          if [ "$rg_exists" = "true" ]; then
+            echo "Resource group exist. Cleaning..."
+            az group delete \
+                --name ${{ env.RESOURCE_GROUP_NAME }} \
+                --yes \
+                --no-wait
+            echo "Resource group deleted...  ${{ env.RESOURCE_GROUP_NAME }}"
+          else
+            echo "Resource group does not exists."
+          fi
+
+      - name: Wait for resource deletion to complete
+        run: |
+
+          # Add resources to the array
+          resources_to_check=("${{ env.OPENAI_RESOURCE_NAME }}")
+
+          echo "List of resources to check: ${resources_to_check[@]}"
+
+          # Maximum number of retries
+          max_retries=3
+
+          # Retry intervals in seconds (30, 60, 120)
+          retry_intervals=(30 60 120)
+
+          # Retry mechanism to check resources
+          retries=0
+          while true; do
+            resource_found=false
+
+            # Get the list of resources in YAML format again on each retry
+            resource_list=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --output yaml)
+
+            # Iterate through the resources to check
+            for resource in "${resources_to_check[@]}"; do
+              echo "Checking resource: $resource"
+              if echo "$resource_list" | grep -q "name: $resource"; then
+                echo "Resource '$resource' exists in the resource group."
+                resource_found=true
+              else
+                echo "Resource '$resource' does not exist in the resource group."
+              fi
+            done
+
+            # If any resource exists, retry
+            if [ "$resource_found" = true ]; then
+              retries=$((retries + 1))
+              if [ "$retries" -gt "$max_retries" ]; then
+                echo "Maximum retry attempts reached. Exiting."
+                break
+              else
+                # Wait for the appropriate interval for the current retry
+                echo "Waiting for ${retry_intervals[$retries-1]} seconds before retrying..."
+                sleep ${retry_intervals[$retries-1]}
+              fi
+            else
+              echo "No resources found. Exiting."
+              break
+            fi
+          done
+
+      - name: Purging the Resources
+        if: always()
+        run: |
+
+          set -e
+          echo "Azure OpenAI: ${{ env.OPENAI_RESOURCE_NAME }}"
+
+          # Purge OpenAI Resource
+          echo "Purging the OpenAI Resource..."
+          if ! az resource delete --ids /subscriptions/${{ secrets.AZURE_SUBSCRIPTION_ID }}/providers/Microsoft.CognitiveServices/locations/eastus/resourceGroups/${{ env.RESOURCE_GROUP_NAME }}/deletedAccounts/${{ env.OPENAI_RESOURCE_NAME }} --verbose; then
+            echo "Failed to purge openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
+          else
+            echo "Purged the openai resource: ${{ env.OPENAI_RESOURCE_NAME }}"
+          fi
+
+          echo "Resource purging completed successfully"
+
+      - name: Send Notification on Failure
+        if: failure()
+        run: |
+          RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
+          # Construct the email body
+          EMAIL_BODY=$(cat <<EOF
+          {
+            "body": "<p>Dear Team,</p><p>We would like to inform you that the Multi-Agent-Custom-Automation-Engine-Solution-Accelerator Automation process has encountered an issue and has failed to complete successfully.</p><p><strong>Build URL:</strong> ${RUN_URL}<br> ${OUTPUT}</p><p>Please investigate the matter at your earliest convenience.</p><p>Best regards,<br>Your Automation Team</p>"
+          }
+          EOF
+          )
+
+          # Send the notification
+          curl -X POST "${{ secrets.LOGIC_APP_URL }}" \
+            -H "Content-Type: application/json" \
+            -d "$EMAIL_BODY" || echo "Failed to send notification"
+      - name: Logout from Azure
+        if: always()
+        run: |
+          az logout
+          echo "Logged out from Azure."

From e2f7f72a9d79142dfa31514d3e712e7a0e67f7d4 Mon Sep 17 00:00:00 2001
From: Kanchan-Microsoft <v-knagshetti@microsoft.com>
Date: Fri, 11 Jul 2025 16:36:16 +0530
Subject: [PATCH 66/70] Delete infra/main.json

---
 infra/main.json | 38787 ----------------------------------------------
 1 file changed, 38787 deletions(-)
 delete mode 100644 infra/main.json

diff --git a/infra/main.json b/infra/main.json
deleted file mode 100644
index f2f142ff3..000000000
--- a/infra/main.json
+++ /dev/null
@@ -1,38787 +0,0 @@
-{
-  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-  "languageVersion": "2.0",
-  "contentVersion": "1.0.0.0",
-  "metadata": {
-    "_generator": {
-      "name": "bicep",
-      "version": "0.36.1.42791",
-      "templateHash": "7207933567592070628"
-    },
-    "name": "Multi-Agent Custom Automation Engine",
-    "description": "This module contains the resources required to deploy the Multi-Agent Custom Automation Engine solution accelerator for both Sandbox environments and WAF aligned environments."
-  },
-  "definitions": {
-    "logAnalyticsWorkspaceConfigurationType": {
-      "type": "object",
-      "properties": {
-        "enabled": {
-          "type": "bool",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. If the Log Analytics Workspace resource should be deployed or not."
-          }
-        },
-        "name": {
-          "type": "string",
-          "nullable": true,
-          "maxLength": 63,
-          "metadata": {
-            "description": "Optional. The name of the Log Analytics Workspace resource."
-          }
-        },
-        "location": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "azd": {
-              "type": "location"
-            },
-            "description": "Optional. Location for the Log Analytics Workspace resource."
-          }
-        },
-        "tags": {
-          "type": "object",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The tags to for the Log Analytics Workspace resource."
-          }
-        },
-        "sku": {
-          "type": "string",
-          "allowedValues": [
-            "CapacityReservation",
-            "Free",
-            "LACluster",
-            "PerGB2018",
-            "PerNode",
-            "Premium",
-            "Standalone",
-            "Standard"
-          ],
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The SKU for the Log Analytics Workspace resource."
-          }
-        },
-        "dataRetentionInDays": {
-          "type": "int",
-          "nullable": true,
-          "maxValue": 730,
-          "metadata": {
-            "description": "Optional. The number of days to retain the data in the Log Analytics Workspace. If empty, it will be set to 365 days."
-          }
-        },
-        "existingWorkspaceResourceId": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional: Existing Log Analytics Workspace Resource ID"
-          }
-        }
-      },
-      "metadata": {
-        "__bicep_export!": true,
-        "description": "The type for the Multi-Agent Custom Automation Engine Log Analytics Workspace resource configuration."
-      }
-    },
-    "applicationInsightsConfigurationType": {
-      "type": "object",
-      "properties": {
-        "enabled": {
-          "type": "bool",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. If the Application Insights resource should be deployed or not."
-          }
-        },
-        "name": {
-          "type": "string",
-          "nullable": true,
-          "maxLength": 90,
-          "metadata": {
-            "description": "Optional. The name of the Application Insights resource."
-          }
-        },
-        "location": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "azd": {
-              "type": "location"
-            },
-            "description": "Optional. Location for the Application Insights resource."
-          }
-        },
-        "tags": {
-          "type": "object",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The tags to set for the Application Insights resource."
-          }
-        },
-        "retentionInDays": {
-          "type": "int",
-          "allowedValues": [
-            120,
-            180,
-            270,
-            30,
-            365,
-            550,
-            60,
-            730,
-            90
-          ],
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The retention of Application Insights data in days. If empty, Standard will be used."
-          }
-        }
-      },
-      "metadata": {
-        "__bicep_export!": true,
-        "description": "The type for the Multi-Agent Custom Automation Engine Application Insights resource configuration."
-      }
-    },
-    "userAssignedManagedIdentityType": {
-      "type": "object",
-      "properties": {
-        "enabled": {
-          "type": "bool",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. If the User Assigned Managed Identity resource should be deployed or not."
-          }
-        },
-        "name": {
-          "type": "string",
-          "nullable": true,
-          "maxLength": 128,
-          "metadata": {
-            "description": "Optional. The name of the User Assigned Managed Identity resource."
-          }
-        },
-        "location": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "azd": {
-              "type": "location"
-            },
-            "description": "Optional. Location for the User Assigned Managed Identity resource."
-          }
-        },
-        "tags": {
-          "type": "object",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The tags to set for the User Assigned Managed Identity resource."
-          }
-        }
-      },
-      "metadata": {
-        "__bicep_export!": true,
-        "description": "The type for the Multi-Agent Custom Automation Engine Application User Assigned Managed Identity resource configuration."
-      }
-    },
-    "networkSecurityGroupConfigurationType": {
-      "type": "object",
-      "properties": {
-        "enabled": {
-          "type": "bool",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. If the Network Security Group resource should be deployed or not."
-          }
-        },
-        "name": {
-          "type": "string",
-          "nullable": true,
-          "maxLength": 90,
-          "metadata": {
-            "description": "Optional. The name of the Network Security Group resource."
-          }
-        },
-        "location": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "azd": {
-              "type": "location"
-            },
-            "description": "Optional. Location for the Network Security Group resource."
-          }
-        },
-        "tags": {
-          "type": "object",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The tags to set for the Network Security Group resource."
-          }
-        },
-        "securityRules": {
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/securityRuleType"
-          },
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The security rules to set for the Network Security Group resource."
-          }
-        }
-      },
-      "metadata": {
-        "description": "The type for the Multi-Agent Custom Automation Engine Network Security Group resource configuration."
-      }
-    },
-    "virtualNetworkConfigurationType": {
-      "type": "object",
-      "properties": {
-        "enabled": {
-          "type": "bool",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. If the Virtual Network resource should be deployed or not."
-          }
-        },
-        "name": {
-          "type": "string",
-          "nullable": true,
-          "maxLength": 90,
-          "metadata": {
-            "description": "Optional. The name of the Virtual Network resource."
-          }
-        },
-        "location": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "azd": {
-              "type": "location"
-            },
-            "description": "Optional. Location for the Virtual Network resource."
-          }
-        },
-        "tags": {
-          "type": "object",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The tags to set for the Virtual Network resource."
-          }
-        },
-        "addressPrefixes": {
-          "type": "array",
-          "items": {
-            "type": "string"
-          },
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. An array of 1 or more IP Addresses prefixes for the Virtual Network resource."
-          }
-        },
-        "subnets": {
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/subnetType"
-          },
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. An array of 1 or more subnets for the Virtual Network resource."
-          }
-        }
-      },
-      "metadata": {
-        "__bicep_export!": true,
-        "description": "The type for the Multi-Agent Custom Automation virtual network resource configuration."
-      }
-    },
-    "subnetType": {
-      "type": "object",
-      "properties": {
-        "name": {
-          "type": "string",
-          "metadata": {
-            "description": "Optional. The Name of the subnet resource."
-          }
-        },
-        "addressPrefix": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Conditional. The address prefix for the subnet. Required if `addressPrefixes` is empty."
-          }
-        },
-        "addressPrefixes": {
-          "type": "array",
-          "items": {
-            "type": "string"
-          },
-          "nullable": true,
-          "metadata": {
-            "description": "Conditional. List of address prefixes for the subnet. Required if `addressPrefix` is empty."
-          }
-        },
-        "applicationGatewayIPConfigurations": {
-          "type": "array",
-          "items": {
-            "type": "object"
-          },
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. Application gateway IP configurations of virtual network resource."
-          }
-        },
-        "delegation": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The delegation to enable on the subnet."
-          }
-        },
-        "natGatewayResourceId": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The resource ID of the NAT Gateway to use for the subnet."
-          }
-        },
-        "networkSecurityGroupResourceId": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The resource ID of the network security group to assign to the subnet."
-          }
-        },
-        "privateEndpointNetworkPolicies": {
-          "type": "string",
-          "allowedValues": [
-            "Disabled",
-            "Enabled",
-            "NetworkSecurityGroupEnabled",
-            "RouteTableEnabled"
-          ],
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. enable or disable apply network policies on private endpoint in the subnet."
-          }
-        },
-        "privateLinkServiceNetworkPolicies": {
-          "type": "string",
-          "allowedValues": [
-            "Disabled",
-            "Enabled"
-          ],
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. enable or disable apply network policies on private link service in the subnet."
-          }
-        },
-        "roleAssignments": {
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/roleAssignmentType"
-          },
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. Array of role assignments to create."
-          }
-        },
-        "routeTableResourceId": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The resource ID of the route table to assign to the subnet."
-          }
-        },
-        "serviceEndpointPolicies": {
-          "type": "array",
-          "items": {
-            "type": "object"
-          },
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. An array of service endpoint policies."
-          }
-        },
-        "serviceEndpoints": {
-          "type": "array",
-          "items": {
-            "type": "string"
-          },
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The service endpoints to enable on the subnet."
-          }
-        },
-        "defaultOutboundAccess": {
-          "type": "bool",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. Set this property to false to disable default outbound connectivity for all VMs in the subnet. This property can only be set at the time of subnet creation and cannot be updated for an existing subnet."
-          }
-        },
-        "sharingScope": {
-          "type": "string",
-          "allowedValues": [
-            "DelegatedServices",
-            "Tenant"
-          ],
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. Set this property to Tenant to allow sharing subnet with other subscriptions in your AAD tenant. This property can only be set if defaultOutboundAccess is set to false, both properties can only be set if subnet is empty."
-          }
-        }
-      }
-    },
-    "bastionConfigurationType": {
-      "type": "object",
-      "properties": {
-        "enabled": {
-          "type": "bool",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. If the Bastion resource should be deployed or not."
-          }
-        },
-        "name": {
-          "type": "string",
-          "nullable": true,
-          "maxLength": 90,
-          "metadata": {
-            "description": "Optional. The name of the Bastion resource."
-          }
-        },
-        "location": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "azd": {
-              "type": "location"
-            },
-            "description": "Optional. Location for the Bastion resource."
-          }
-        },
-        "tags": {
-          "type": "object",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The tags to set for the Bastion resource."
-          }
-        },
-        "sku": {
-          "type": "string",
-          "allowedValues": [
-            "Basic",
-            "Developer",
-            "Premium",
-            "Standard"
-          ],
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The SKU for the Bastion resource."
-          }
-        },
-        "virtualNetworkResourceId": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The Virtual Network resource id where the Bastion resource should be deployed."
-          }
-        },
-        "publicIpResourceName": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The name of the Public Ip resource created to connect to Bastion."
-          }
-        }
-      },
-      "metadata": {
-        "__bicep_export!": true,
-        "description": "The type for the Multi-Agent Custom Automation Engine Bastion resource configuration."
-      }
-    },
-    "virtualMachineConfigurationType": {
-      "type": "object",
-      "properties": {
-        "enabled": {
-          "type": "bool",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. If the Virtual Machine resource should be deployed or not."
-          }
-        },
-        "name": {
-          "type": "string",
-          "nullable": true,
-          "maxLength": 90,
-          "metadata": {
-            "description": "Optional. The name of the Virtual Machine resource."
-          }
-        },
-        "location": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "azd": {
-              "type": "location"
-            },
-            "description": "Optional. Location for the Virtual Machine resource."
-          }
-        },
-        "tags": {
-          "type": "object",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The tags to set for the Virtual Machine resource."
-          }
-        },
-        "vmSize": {
-          "type": "string",
-          "allowedValues": [
-            "Basic_A0",
-            "Basic_A1",
-            "Basic_A2",
-            "Basic_A3",
-            "Basic_A4",
-            "Standard_A0",
-            "Standard_A1",
-            "Standard_A10",
-            "Standard_A11",
-            "Standard_A1_v2",
-            "Standard_A2",
-            "Standard_A2_v2",
-            "Standard_A2m_v2",
-            "Standard_A3",
-            "Standard_A4",
-            "Standard_A4_v2",
-            "Standard_A4m_v2",
-            "Standard_A5",
-            "Standard_A6",
-            "Standard_A7",
-            "Standard_A8",
-            "Standard_A8_v2",
-            "Standard_A8m_v2",
-            "Standard_A9",
-            "Standard_B1ms",
-            "Standard_B1s",
-            "Standard_B2ms",
-            "Standard_B2s",
-            "Standard_B4ms",
-            "Standard_B8ms",
-            "Standard_D1",
-            "Standard_D11",
-            "Standard_D11_v2",
-            "Standard_D12",
-            "Standard_D12_v2",
-            "Standard_D13",
-            "Standard_D13_v2",
-            "Standard_D14",
-            "Standard_D14_v2",
-            "Standard_D15_v2",
-            "Standard_D16_v3",
-            "Standard_D16s_v3",
-            "Standard_D1_v2",
-            "Standard_D2",
-            "Standard_D2_v2",
-            "Standard_D2_v3",
-            "Standard_D2s_v3",
-            "Standard_D3",
-            "Standard_D32_v3",
-            "Standard_D32s_v3",
-            "Standard_D3_v2",
-            "Standard_D4",
-            "Standard_D4_v2",
-            "Standard_D4_v3",
-            "Standard_D4s_v3",
-            "Standard_D5_v2",
-            "Standard_D64_v3",
-            "Standard_D64s_v3",
-            "Standard_D8_v3",
-            "Standard_D8s_v3",
-            "Standard_DS1",
-            "Standard_DS11",
-            "Standard_DS11_v2",
-            "Standard_DS12",
-            "Standard_DS12_v2",
-            "Standard_DS13",
-            "Standard_DS13-2_v2",
-            "Standard_DS13-4_v2",
-            "Standard_DS13_v2",
-            "Standard_DS14",
-            "Standard_DS14-4_v2",
-            "Standard_DS14-8_v2",
-            "Standard_DS14_v2",
-            "Standard_DS15_v2",
-            "Standard_DS1_v2",
-            "Standard_DS2",
-            "Standard_DS2_v2",
-            "Standard_DS3",
-            "Standard_DS3_v2",
-            "Standard_DS4",
-            "Standard_DS4_v2",
-            "Standard_DS5_v2",
-            "Standard_E16_v3",
-            "Standard_E16s_v3",
-            "Standard_E2_v3",
-            "Standard_E2s_v3",
-            "Standard_E32-16_v3",
-            "Standard_E32-8s_v3",
-            "Standard_E32_v3",
-            "Standard_E32s_v3",
-            "Standard_E4_v3",
-            "Standard_E4s_v3",
-            "Standard_E64-16s_v3",
-            "Standard_E64-32s_v3",
-            "Standard_E64_v3",
-            "Standard_E64s_v3",
-            "Standard_E8_v3",
-            "Standard_E8s_v3",
-            "Standard_F1",
-            "Standard_F16",
-            "Standard_F16s",
-            "Standard_F16s_v2",
-            "Standard_F1s",
-            "Standard_F2",
-            "Standard_F2s",
-            "Standard_F2s_v2",
-            "Standard_F32s_v2",
-            "Standard_F4",
-            "Standard_F4s",
-            "Standard_F4s_v2",
-            "Standard_F64s_v2",
-            "Standard_F72s_v2",
-            "Standard_F8",
-            "Standard_F8s",
-            "Standard_F8s_v2",
-            "Standard_G1",
-            "Standard_G2",
-            "Standard_G3",
-            "Standard_G4",
-            "Standard_G5",
-            "Standard_GS1",
-            "Standard_GS2",
-            "Standard_GS3",
-            "Standard_GS4",
-            "Standard_GS4-4",
-            "Standard_GS4-8",
-            "Standard_GS5",
-            "Standard_GS5-16",
-            "Standard_GS5-8",
-            "Standard_H16",
-            "Standard_H16m",
-            "Standard_H16mr",
-            "Standard_H16r",
-            "Standard_H8",
-            "Standard_H8m",
-            "Standard_L16s",
-            "Standard_L32s",
-            "Standard_L4s",
-            "Standard_L8s",
-            "Standard_M128-32ms",
-            "Standard_M128-64ms",
-            "Standard_M128ms",
-            "Standard_M128s",
-            "Standard_M64-16ms",
-            "Standard_M64-32ms",
-            "Standard_M64ms",
-            "Standard_M64s",
-            "Standard_NC12",
-            "Standard_NC12s_v2",
-            "Standard_NC12s_v3",
-            "Standard_NC24",
-            "Standard_NC24r",
-            "Standard_NC24rs_v2",
-            "Standard_NC24rs_v3",
-            "Standard_NC24s_v2",
-            "Standard_NC24s_v3",
-            "Standard_NC6",
-            "Standard_NC6s_v2",
-            "Standard_NC6s_v3",
-            "Standard_ND12s",
-            "Standard_ND24rs",
-            "Standard_ND24s",
-            "Standard_ND6s",
-            "Standard_NV12",
-            "Standard_NV24",
-            "Standard_NV6"
-          ],
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. Specifies the size for the Virtual Machine resource."
-          }
-        },
-        "adminUsername": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The username for the administrator account on the virtual machine. Required if a virtual machine is created as part of the module."
-          }
-        },
-        "adminPassword": {
-          "type": "securestring",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The password for the administrator account on the virtual machine. Required if a virtual machine is created as part of the module."
-          }
-        },
-        "subnetResourceId": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The resource ID of the subnet where the Virtual Machine resource should be deployed."
-          }
-        }
-      },
-      "metadata": {
-        "__bicep_export!": true,
-        "description": "The type for the Multi-Agent Custom Automation Engine virtual machine resource configuration."
-      }
-    },
-    "aiServicesConfigurationType": {
-      "type": "object",
-      "properties": {
-        "enabled": {
-          "type": "bool",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. If the AI Services resource should be deployed or not."
-          }
-        },
-        "name": {
-          "type": "string",
-          "nullable": true,
-          "maxLength": 90,
-          "metadata": {
-            "description": "Optional. The name of the AI Services resource."
-          }
-        },
-        "location": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "azd": {
-              "type": "location"
-            },
-            "description": "Optional. Location for the AI Services resource."
-          }
-        },
-        "tags": {
-          "type": "object",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The tags to set for the AI Services resource."
-          }
-        },
-        "sku": {
-          "type": "string",
-          "allowedValues": [
-            "C2",
-            "C3",
-            "C4",
-            "F0",
-            "F1",
-            "S",
-            "S0",
-            "S1",
-            "S10",
-            "S2",
-            "S3",
-            "S4",
-            "S5",
-            "S6",
-            "S7",
-            "S8",
-            "S9"
-          ],
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The SKU of the AI Services resource. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region."
-          }
-        },
-        "subnetResourceId": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The resource Id of the subnet where the AI Services private endpoint should be created."
-          }
-        },
-        "deployments": {
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/deploymentType"
-          },
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The model deployments to set for the AI Services resource."
-          }
-        },
-        "modelCapacity": {
-          "type": "int",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The capacity to set for AI Services GTP model."
-          }
-        }
-      },
-      "metadata": {
-        "description": "The type for the Multi-Agent Custom Automation Engine AI Services resource configuration."
-      }
-    },
-    "aiProjectConfigurationType": {
-      "type": "object",
-      "properties": {
-        "enabled": {
-          "type": "bool",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. If the AI Project resource should be deployed or not."
-          }
-        },
-        "name": {
-          "type": "string",
-          "nullable": true,
-          "maxLength": 90,
-          "metadata": {
-            "description": "Optional. The name of the AI Project resource."
-          }
-        },
-        "location": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "azd": {
-              "type": "location"
-            },
-            "description": "Optional. Location for the AI Project resource deployment."
-          }
-        },
-        "sku": {
-          "type": "string",
-          "allowedValues": [
-            "Basic",
-            "Free",
-            "Premium",
-            "Standard"
-          ],
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The SKU of the AI Project resource."
-          }
-        },
-        "tags": {
-          "type": "object",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The tags to set for the AI Project resource."
-          }
-        }
-      },
-      "metadata": {
-        "__bicep_export!": true,
-        "description": "The type for the Multi-Agent Custom Automation Engine AI Foundry AI Project resource configuration."
-      }
-    },
-    "cosmosDbAccountConfigurationType": {
-      "type": "object",
-      "properties": {
-        "enabled": {
-          "type": "bool",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. If the Cosmos DB Account resource should be deployed or not."
-          }
-        },
-        "name": {
-          "type": "string",
-          "nullable": true,
-          "maxLength": 60,
-          "metadata": {
-            "description": "Optional. The name of the Cosmos DB Account resource."
-          }
-        },
-        "location": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "azd": {
-              "type": "location"
-            },
-            "description": "Optional. Location for the Cosmos DB Account resource."
-          }
-        },
-        "tags": {
-          "type": "object",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The tags to set for the Cosmos DB Account resource."
-          }
-        },
-        "subnetResourceId": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The resource Id of the subnet where the Cosmos DB Account private endpoint should be created."
-          }
-        },
-        "sqlDatabases": {
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/sqlDatabaseType"
-          },
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The SQL databases configuration for the Cosmos DB Account resource."
-          }
-        }
-      },
-      "metadata": {
-        "__bicep_export!": true,
-        "description": "The type for the Multi-Agent Custom Automation Engine Cosmos DB Account resource configuration."
-      }
-    },
-    "containerAppEnvironmentConfigurationType": {
-      "type": "object",
-      "properties": {
-        "enabled": {
-          "type": "bool",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. If the Container App Environment resource should be deployed or not."
-          }
-        },
-        "name": {
-          "type": "string",
-          "nullable": true,
-          "maxLength": 60,
-          "metadata": {
-            "description": "Optional. The name of the Container App Environment resource."
-          }
-        },
-        "location": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "azd": {
-              "type": "location"
-            },
-            "description": "Optional. Location for the Container App Environment resource."
-          }
-        },
-        "tags": {
-          "type": "object",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The tags to set for the Container App Environment resource."
-          }
-        },
-        "subnetResourceId": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The resource Id of the subnet where the Container App Environment private endpoint should be created."
-          }
-        }
-      },
-      "metadata": {
-        "__bicep_export!": true,
-        "description": "The type for the Multi-Agent Custom Automation Engine Container App Environment resource configuration."
-      }
-    },
-    "containerAppConfigurationType": {
-      "type": "object",
-      "properties": {
-        "enabled": {
-          "type": "bool",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. If the Container App resource should be deployed or not."
-          }
-        },
-        "name": {
-          "type": "string",
-          "nullable": true,
-          "maxLength": 60,
-          "metadata": {
-            "description": "Optional. The name of the Container App resource."
-          }
-        },
-        "location": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "azd": {
-              "type": "location"
-            },
-            "description": "Optional. Location for the Container App resource."
-          }
-        },
-        "tags": {
-          "type": "object",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The tags to set for the Container App resource."
-          }
-        },
-        "environmentResourceId": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The resource Id of the Container App Environment where the Container App should be created."
-          }
-        },
-        "maxReplicas": {
-          "type": "int",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The maximum number of replicas of the Container App."
-          }
-        },
-        "minReplicas": {
-          "type": "int",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The minimum number of replicas of the Container App."
-          }
-        },
-        "ingressTargetPort": {
-          "type": "int",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The ingress target port of the Container App."
-          }
-        },
-        "concurrentRequests": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The concurrent requests allowed for the Container App."
-          }
-        },
-        "containerName": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The name given to the Container App."
-          }
-        },
-        "containerImageRegistryDomain": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The container registry domain of the container image to be used by the Container App. Default to `biabcontainerreg.azurecr.io`"
-          }
-        },
-        "containerImageName": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The name of the container image to be used by the Container App."
-          }
-        },
-        "containerImageTag": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The tag of the container image to be used by the Container App."
-          }
-        },
-        "containerCpu": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The CPU reserved for the Container App. Defaults to 2.0"
-          }
-        },
-        "containerMemory": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The Memory reserved for the Container App. Defaults to 4.0Gi"
-          }
-        }
-      },
-      "metadata": {
-        "__bicep_export!": true,
-        "description": "The type for the Multi-Agent Custom Automation Engine Container App resource configuration."
-      }
-    },
-    "entraIdApplicationConfigurationType": {
-      "type": "object",
-      "properties": {
-        "enabled": {
-          "type": "bool",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. If the Entra ID Application for website authentication should be deployed or not."
-          }
-        }
-      },
-      "metadata": {
-        "__bicep_export!": true,
-        "description": "The type for the Multi-Agent Custom Automation Engine Entra ID Application resource configuration."
-      }
-    },
-    "webServerFarmConfigurationType": {
-      "type": "object",
-      "properties": {
-        "enabled": {
-          "type": "bool",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. If the Web Server Farm resource should be deployed or not."
-          }
-        },
-        "name": {
-          "type": "string",
-          "nullable": true,
-          "maxLength": 60,
-          "metadata": {
-            "description": "Optional. The name of the Web Server Farm resource."
-          }
-        },
-        "location": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "azd": {
-              "type": "location"
-            },
-            "description": "Optional. Location for the Web Server Farm resource."
-          }
-        },
-        "tags": {
-          "type": "object",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The tags to set for the Web Server Farm resource."
-          }
-        },
-        "skuName": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The name of th SKU that will determine the tier, size and family for the Web Server Farm resource. This defaults to P1v3 to leverage availability zones."
-          }
-        },
-        "skuCapacity": {
-          "type": "int",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. Number of workers associated with the App Service Plan. This defaults to 3, to leverage availability zones."
-          }
-        }
-      },
-      "metadata": {
-        "__bicep_export!": true,
-        "description": "The type for the Multi-Agent Custom Automation Engine Web Server Farm resource configuration."
-      }
-    },
-    "webSiteConfigurationType": {
-      "type": "object",
-      "properties": {
-        "enabled": {
-          "type": "bool",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. If the Web Site resource should be deployed or not."
-          }
-        },
-        "name": {
-          "type": "string",
-          "nullable": true,
-          "maxLength": 60,
-          "metadata": {
-            "description": "Optional. The name of the Web Site resource."
-          }
-        },
-        "location": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "azd": {
-              "type": "location"
-            },
-            "description": "Optional. Location for the Web Site resource deployment."
-          }
-        },
-        "tags": {
-          "type": "object",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The tags to set for the Web Site resource."
-          }
-        },
-        "environmentResourceId": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The resource Id of the Web Site Environment where the Web Site should be created."
-          }
-        },
-        "containerName": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The name given to the Container App."
-          }
-        },
-        "containerImageRegistryDomain": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The container registry domain of the container image to be used by the Web Site. Default to `biabcontainerreg.azurecr.io`"
-          }
-        },
-        "containerImageName": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The name of the container image to be used by the Web Site."
-          }
-        },
-        "containerImageTag": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The tag of the container image to be used by the Web Site."
-          }
-        }
-      },
-      "metadata": {
-        "__bicep_export!": true,
-        "description": "The type for the Multi-Agent Custom Automation Engine Web Site resource configuration."
-      }
-    },
-    "deploymentType": {
-      "type": "object",
-      "properties": {
-        "name": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. Specify the name of cognitive service account deployment."
-          }
-        },
-        "model": {
-          "type": "object",
-          "properties": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. The name of Cognitive Services account deployment model."
-              }
-            },
-            "format": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. The format of Cognitive Services account deployment model."
-              }
-            },
-            "version": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. The version of Cognitive Services account deployment model."
-              }
-            }
-          },
-          "metadata": {
-            "description": "Required. Properties of Cognitive Services account deployment model."
-          }
-        },
-        "sku": {
-          "type": "object",
-          "properties": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. The name of the resource model definition representing SKU."
-              }
-            },
-            "capacity": {
-              "type": "int",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The capacity of the resource model definition representing SKU."
-              }
-            },
-            "tier": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The tier of the resource model definition representing SKU."
-              }
-            },
-            "size": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The size of the resource model definition representing SKU."
-              }
-            },
-            "family": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The family of the resource model definition representing SKU."
-              }
-            }
-          },
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The resource model definition representing SKU."
-          }
-        },
-        "raiPolicyName": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The name of RAI policy."
-          }
-        },
-        "versionUpgradeOption": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The version upgrade option."
-          }
-        }
-      },
-      "metadata": {
-        "description": "The type for a cognitive services account deployment.",
-        "__bicep_imported_from!": {
-          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/cognitive-services/account:0.10.2"
-        }
-      }
-    },
-    "roleAssignmentType": {
-      "type": "object",
-      "properties": {
-        "name": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-          }
-        },
-        "roleDefinitionIdOrName": {
-          "type": "string",
-          "metadata": {
-            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-          }
-        },
-        "principalId": {
-          "type": "string",
-          "metadata": {
-            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-          }
-        },
-        "principalType": {
-          "type": "string",
-          "allowedValues": [
-            "Device",
-            "ForeignGroup",
-            "Group",
-            "ServicePrincipal",
-            "User"
-          ],
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The principal type of the assigned principal ID."
-          }
-        },
-        "description": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The description of the role assignment."
-          }
-        },
-        "condition": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-          }
-        },
-        "conditionVersion": {
-          "type": "string",
-          "allowedValues": [
-            "2.0"
-          ],
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. Version of the condition."
-          }
-        },
-        "delegatedManagedIdentityResourceId": {
-          "type": "string",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. The Resource Id of the delegated managed identity resource."
-          }
-        }
-      },
-      "metadata": {
-        "description": "An AVM-aligned type for a role assignment.",
-        "__bicep_imported_from!": {
-          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-        }
-      }
-    },
-    "securityRuleType": {
-      "type": "object",
-      "properties": {
-        "name": {
-          "type": "string",
-          "metadata": {
-            "description": "Required. The name of the security rule."
-          }
-        },
-        "properties": {
-          "type": "object",
-          "properties": {
-            "access": {
-              "type": "string",
-              "allowedValues": [
-                "Allow",
-                "Deny"
-              ],
-              "metadata": {
-                "description": "Required. Whether network traffic is allowed or denied."
-              }
-            },
-            "description": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The description of the security rule."
-              }
-            },
-            "destinationAddressPrefix": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Optional. The destination address prefix. CIDR or destination IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used."
-              }
-            },
-            "destinationAddressPrefixes": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The destination address prefixes. CIDR or destination IP ranges."
-              }
-            },
-            "destinationApplicationSecurityGroupResourceIds": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The resource IDs of the application security groups specified as destination."
-              }
-            },
-            "destinationPortRange": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The destination port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
-              }
-            },
-            "destinationPortRanges": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The destination port ranges."
-              }
-            },
-            "direction": {
-              "type": "string",
-              "allowedValues": [
-                "Inbound",
-                "Outbound"
-              ],
-              "metadata": {
-                "description": "Required. The direction of the rule. The direction specifies if rule will be evaluated on incoming or outgoing traffic."
-              }
-            },
-            "priority": {
-              "type": "int",
-              "minValue": 100,
-              "maxValue": 4096,
-              "metadata": {
-                "description": "Required. Required. The priority of the rule. The value can be between 100 and 4096. The priority number must be unique for each rule in the collection. The lower the priority number, the higher the priority of the rule."
-              }
-            },
-            "protocol": {
-              "type": "string",
-              "allowedValues": [
-                "*",
-                "Ah",
-                "Esp",
-                "Icmp",
-                "Tcp",
-                "Udp"
-              ],
-              "metadata": {
-                "description": "Required. Network protocol this rule applies to."
-              }
-            },
-            "sourceAddressPrefix": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The CIDR or source IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used. If this is an ingress rule, specifies where network traffic originates from."
-              }
-            },
-            "sourceAddressPrefixes": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The CIDR or source IP ranges."
-              }
-            },
-            "sourceApplicationSecurityGroupResourceIds": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The resource IDs of the application security groups specified as source."
-              }
-            },
-            "sourcePortRange": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The source port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
-              }
-            },
-            "sourcePortRanges": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The source port ranges."
-              }
-            }
-          },
-          "metadata": {
-            "description": "Required. The properties of the security rule."
-          }
-        }
-      },
-      "metadata": {
-        "description": "The type of a security rule.",
-        "__bicep_imported_from!": {
-          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-security-group:0.5.1"
-        }
-      }
-    },
-    "sqlDatabaseType": {
-      "type": "object",
-      "properties": {
-        "name": {
-          "type": "string",
-          "metadata": {
-            "description": "Required. Name of the SQL database ."
-          }
-        },
-        "throughput": {
-          "type": "int",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. Default to 400. Request units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
-          }
-        },
-        "autoscaleSettingsMaxThroughput": {
-          "type": "int",
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
-          }
-        },
-        "containers": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "properties": {
-              "name": {
-                "type": "string",
-                "metadata": {
-                  "description": "Required. Name of the container."
-                }
-              },
-              "paths": {
-                "type": "array",
-                "items": {
-                  "type": "string"
-                },
-                "minLength": 1,
-                "maxLength": 3,
-                "metadata": {
-                  "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1."
-                }
-              },
-              "analyticalStorageTtl": {
-                "type": "int",
-                "nullable": true,
-                "metadata": {
-                  "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store."
-                }
-              },
-              "autoscaleSettingsMaxThroughput": {
-                "type": "int",
-                "nullable": true,
-                "maxValue": 1000000,
-                "metadata": {
-                  "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level."
-                }
-              },
-              "conflictResolutionPolicy": {
-                "type": "object",
-                "properties": {
-                  "conflictResolutionPath": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Conditional. The conflict resolution path in the case of LastWriterWins mode. Required if `mode` is set to 'LastWriterWins'."
-                    }
-                  },
-                  "conflictResolutionProcedure": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Conditional. The procedure to resolve conflicts in the case of custom mode. Required if `mode` is set to 'Custom'."
-                    }
-                  },
-                  "mode": {
-                    "type": "string",
-                    "allowedValues": [
-                      "Custom",
-                      "LastWriterWins"
-                    ],
-                    "metadata": {
-                      "description": "Required. Indicates the conflict resolution mode."
-                    }
-                  }
-                },
-                "nullable": true,
-                "metadata": {
-                  "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions."
-                }
-              },
-              "defaultTtl": {
-                "type": "int",
-                "nullable": true,
-                "minValue": -1,
-                "maxValue": 2147483647,
-                "metadata": {
-                  "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default."
-                }
-              },
-              "indexingPolicy": {
-                "type": "object",
-                "nullable": true,
-                "metadata": {
-                  "description": "Optional. Indexing policy of the container."
-                }
-              },
-              "kind": {
-                "type": "string",
-                "allowedValues": [
-                  "Hash",
-                  "MultiHash"
-                ],
-                "nullable": true,
-                "metadata": {
-                  "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning."
-                }
-              },
-              "version": {
-                "type": "int",
-                "allowedValues": [
-                  1,
-                  2
-                ],
-                "nullable": true,
-                "metadata": {
-                  "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition."
-                }
-              },
-              "throughput": {
-                "type": "int",
-                "nullable": true,
-                "metadata": {
-                  "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used."
-                }
-              },
-              "uniqueKeyPolicyKeys": {
-                "type": "array",
-                "items": {
-                  "type": "object",
-                  "properties": {
-                    "paths": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "metadata": {
-                        "description": "Required. List of paths must be unique for each document in the Azure Cosmos DB service."
-                      }
-                    }
-                  }
-                },
-                "nullable": true,
-                "metadata": {
-                  "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service."
-                }
-              }
-            }
-          },
-          "nullable": true,
-          "metadata": {
-            "description": "Optional. Array of containers to deploy in the SQL database."
-          }
-        }
-      },
-      "metadata": {
-        "description": "The type for the SQL database.",
-        "__bicep_imported_from!": {
-          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/document-db/database-account:0.13.0"
-        }
-      }
-    }
-  },
-  "parameters": {
-    "solutionPrefix": {
-      "type": "string",
-      "defaultValue": "[format('macae{0}', uniqueString(deployer().objectId, deployer().tenantId, subscription().subscriptionId, resourceGroup().id))]",
-      "maxLength": 19,
-      "metadata": {
-        "description": "Optional. The prefix to add in the default names given to all deployed Azure resources."
-      }
-    },
-    "solutionLocation": {
-      "type": "string",
-      "defaultValue": "[resourceGroup().location]",
-      "metadata": {
-        "description": "Required. Location for all Resources except AI Foundry."
-      }
-    },
-    "enableTelemetry": {
-      "type": "bool",
-      "defaultValue": true,
-      "metadata": {
-        "description": "Optional. Enable/Disable usage telemetry for module."
-      }
-    },
-    "azureOpenAILocation": {
-      "type": "string",
-      "allowedValues": [
-        "australiaeast",
-        "eastus2",
-        "francecentral",
-        "japaneast",
-        "norwayeast",
-        "swedencentral",
-        "uksouth",
-        "westus"
-      ],
-      "metadata": {
-        "description": "Azure OpenAI Location"
-      }
-    },
-    "gptModelName": {
-      "type": "string",
-      "defaultValue": "gpt-4o",
-      "minLength": 1,
-      "metadata": {
-        "description": "Name of the GPT model to deploy:"
-      }
-    },
-    "gptModelVersion": {
-      "type": "string",
-      "defaultValue": "2024-08-06"
-    },
-    "modelDeploymentType": {
-      "type": "string",
-      "defaultValue": "GlobalStandard",
-      "minLength": 1,
-      "metadata": {
-        "description": "GPT model deployment type:"
-      }
-    },
-    "imageTag": {
-      "type": "string",
-      "defaultValue": "latest",
-      "metadata": {
-        "description": "Set the image tag for the container images used in the solution. Default is \"latest\"."
-      }
-    },
-    "tags": {
-      "type": "object",
-      "defaultValue": {
-        "app": "[parameters('solutionPrefix')]",
-        "location": "[parameters('solutionLocation')]"
-      },
-      "metadata": {
-        "description": "Optional. The tags to apply to all deployed Azure resources."
-      }
-    },
-    "logAnalyticsWorkspaceConfiguration": {
-      "$ref": "#/definitions/logAnalyticsWorkspaceConfigurationType",
-      "defaultValue": {
-        "enabled": true,
-        "name": "[format('log-{0}', parameters('solutionPrefix'))]",
-        "location": "[parameters('solutionLocation')]",
-        "sku": "PerGB2018",
-        "tags": "[parameters('tags')]",
-        "dataRetentionInDays": 365,
-        "existingWorkspaceResourceId": ""
-      },
-      "metadata": {
-        "description": "Optional. The configuration to apply for the Multi-Agent Custom Automation Engine Log Analytics Workspace resource."
-      }
-    },
-    "applicationInsightsConfiguration": {
-      "$ref": "#/definitions/applicationInsightsConfigurationType",
-      "defaultValue": {
-        "enabled": true,
-        "name": "[format('appi-{0}', parameters('solutionPrefix'))]",
-        "location": "[parameters('solutionLocation')]",
-        "tags": "[parameters('tags')]",
-        "retentionInDays": 365
-      },
-      "metadata": {
-        "description": "Optional. The configuration to apply for the Multi-Agent Custom Automation Engine Application Insights resource."
-      }
-    },
-    "userAssignedManagedIdentityConfiguration": {
-      "$ref": "#/definitions/userAssignedManagedIdentityType",
-      "defaultValue": {
-        "enabled": true,
-        "name": "[format('id-{0}', parameters('solutionPrefix'))]",
-        "location": "[parameters('solutionLocation')]",
-        "tags": "[parameters('tags')]"
-      },
-      "metadata": {
-        "description": "Optional. The configuration to apply for the Multi-Agent Custom Automation Engine Managed Identity resource."
-      }
-    },
-    "networkSecurityGroupBackendConfiguration": {
-      "$ref": "#/definitions/networkSecurityGroupConfigurationType",
-      "defaultValue": {
-        "enabled": true,
-        "name": "[format('nsg-backend-{0}', parameters('solutionPrefix'))]",
-        "location": "[parameters('solutionLocation')]",
-        "tags": "[parameters('tags')]",
-        "securityRules": null
-      },
-      "metadata": {
-        "description": "Optional. The configuration to apply for the Multi-Agent Custom Automation Engine Network Security Group resource for the backend subnet."
-      }
-    },
-    "networkSecurityGroupContainersConfiguration": {
-      "$ref": "#/definitions/networkSecurityGroupConfigurationType",
-      "defaultValue": {
-        "enabled": true,
-        "name": "[format('nsg-containers-{0}', parameters('solutionPrefix'))]",
-        "location": "[parameters('solutionLocation')]",
-        "tags": "[parameters('tags')]",
-        "securityRules": null
-      },
-      "metadata": {
-        "description": "Optional. The configuration to apply for the Multi-Agent Custom Automation Engine Network Security Group resource for the containers subnet."
-      }
-    },
-    "networkSecurityGroupBastionConfiguration": {
-      "$ref": "#/definitions/networkSecurityGroupConfigurationType",
-      "defaultValue": {
-        "enabled": true,
-        "name": "[format('nsg-bastion-{0}', parameters('solutionPrefix'))]",
-        "location": "[parameters('solutionLocation')]",
-        "tags": "[parameters('tags')]",
-        "securityRules": null
-      },
-      "metadata": {
-        "description": "Optional. The configuration to apply for the Multi-Agent Custom Automation Engine Network Security Group resource for the Bastion subnet."
-      }
-    },
-    "networkSecurityGroupAdministrationConfiguration": {
-      "$ref": "#/definitions/networkSecurityGroupConfigurationType",
-      "defaultValue": {
-        "enabled": true,
-        "name": "[format('nsg-administration-{0}', parameters('solutionPrefix'))]",
-        "location": "[parameters('solutionLocation')]",
-        "tags": "[parameters('tags')]",
-        "securityRules": null
-      },
-      "metadata": {
-        "description": "Optional. The configuration to apply for the Multi-Agent Custom Automation Engine Network Security Group resource for the administration subnet."
-      }
-    },
-    "virtualNetworkConfiguration": {
-      "$ref": "#/definitions/virtualNetworkConfigurationType",
-      "defaultValue": {
-        "enabled": true,
-        "name": "[format('vnet-{0}', parameters('solutionPrefix'))]",
-        "location": "[parameters('solutionLocation')]",
-        "tags": "[parameters('tags')]",
-        "addressPrefixes": null,
-        "subnets": null
-      },
-      "metadata": {
-        "description": "Optional. The configuration to apply for the Multi-Agent Custom Automation Engine virtual network resource."
-      }
-    },
-    "bastionConfiguration": {
-      "$ref": "#/definitions/bastionConfigurationType",
-      "defaultValue": {
-        "enabled": true,
-        "name": "[format('bas-{0}', parameters('solutionPrefix'))]",
-        "location": "[parameters('solutionLocation')]",
-        "tags": "[parameters('tags')]",
-        "sku": "Standard",
-        "virtualNetworkResourceId": null,
-        "publicIpResourceName": "[format('pip-bas{0}', parameters('solutionPrefix'))]"
-      },
-      "metadata": {
-        "description": "Optional. The configuration to apply for the Multi-Agent Custom Automation Engine bastion resource."
-      }
-    },
-    "virtualMachineConfiguration": {
-      "$ref": "#/definitions/virtualMachineConfigurationType",
-      "defaultValue": {
-        "enabled": true,
-        "name": "[format('vm{0}', parameters('solutionPrefix'))]",
-        "location": "[parameters('solutionLocation')]",
-        "tags": "[parameters('tags')]",
-        "adminUsername": "adminuser",
-        "adminPassword": "[guid(parameters('solutionPrefix'), subscription().subscriptionId)]",
-        "vmSize": "Standard_D2s_v3",
-        "subnetResourceId": null
-      },
-      "metadata": {
-        "description": "Optional. Configuration for the Windows virtual machine."
-      }
-    },
-    "aiFoundryAiServicesConfiguration": {
-      "$ref": "#/definitions/aiServicesConfigurationType",
-      "defaultValue": {
-        "enabled": true,
-        "name": "[format('aisa-{0}', parameters('solutionPrefix'))]",
-        "location": "[parameters('azureOpenAILocation')]",
-        "sku": "S0",
-        "deployments": null,
-        "subnetResourceId": null,
-        "modelCapacity": 50
-      },
-      "metadata": {
-        "description": "Optional. The configuration to apply for the AI Foundry AI Services resource."
-      }
-    },
-    "aiFoundryAiProjectConfiguration": {
-      "$ref": "#/definitions/aiProjectConfigurationType",
-      "defaultValue": {
-        "enabled": true,
-        "name": "[format('aifp-{0}', parameters('solutionPrefix'))]",
-        "location": "[parameters('azureOpenAILocation')]",
-        "sku": "Basic",
-        "tags": "[parameters('tags')]"
-      },
-      "metadata": {
-        "description": "Optional. The configuration to apply for the AI Foundry AI Project resource."
-      }
-    },
-    "cosmosDbAccountConfiguration": {
-      "$ref": "#/definitions/cosmosDbAccountConfigurationType",
-      "defaultValue": {
-        "enabled": true,
-        "name": "[format('cosmos-{0}', parameters('solutionPrefix'))]",
-        "location": "[parameters('solutionLocation')]",
-        "tags": "[parameters('tags')]",
-        "subnetResourceId": null,
-        "sqlDatabases": null
-      },
-      "metadata": {
-        "description": "Optional. The configuration to apply for the Cosmos DB Account resource."
-      }
-    },
-    "containerAppEnvironmentConfiguration": {
-      "$ref": "#/definitions/containerAppEnvironmentConfigurationType",
-      "defaultValue": {
-        "enabled": true,
-        "name": "[format('cae-{0}', parameters('solutionPrefix'))]",
-        "location": "[parameters('solutionLocation')]",
-        "tags": "[parameters('tags')]",
-        "subnetResourceId": null
-      },
-      "metadata": {
-        "description": "Optional. The configuration to apply for the Container App Environment resource."
-      }
-    },
-    "containerAppConfiguration": {
-      "$ref": "#/definitions/containerAppConfigurationType",
-      "defaultValue": {
-        "enabled": true,
-        "name": "[format('ca-{0}', parameters('solutionPrefix'))]",
-        "location": "[parameters('solutionLocation')]",
-        "tags": "[parameters('tags')]",
-        "environmentResourceId": null,
-        "concurrentRequests": "100",
-        "containerCpu": "2.0",
-        "containerMemory": "4.0Gi",
-        "containerImageRegistryDomain": "biabcontainerreg.azurecr.io",
-        "containerImageName": "macaebackend",
-        "containerImageTag": "[parameters('imageTag')]",
-        "containerName": "backend",
-        "ingressTargetPort": 8000,
-        "maxReplicas": 1,
-        "minReplicas": 1
-      },
-      "metadata": {
-        "description": "Optional. The configuration to apply for the Container App resource."
-      }
-    },
-    "webServerFarmConfiguration": {
-      "$ref": "#/definitions/webServerFarmConfigurationType",
-      "defaultValue": {
-        "enabled": true,
-        "name": "[format('asp-{0}', parameters('solutionPrefix'))]",
-        "location": "[parameters('solutionLocation')]",
-        "skuName": "P1v3",
-        "skuCapacity": 3,
-        "tags": "[parameters('tags')]"
-      },
-      "metadata": {
-        "description": "Optional. The configuration to apply for the Web Server Farm resource."
-      }
-    },
-    "webSiteConfiguration": {
-      "$ref": "#/definitions/webSiteConfigurationType",
-      "defaultValue": {
-        "enabled": true,
-        "name": "[format('app-{0}', parameters('solutionPrefix'))]",
-        "location": "[parameters('solutionLocation')]",
-        "containerImageRegistryDomain": "biabcontainerreg.azurecr.io",
-        "containerImageName": "macaefrontend",
-        "containerImageTag": "[parameters('imageTag')]",
-        "containerName": "backend",
-        "tags": "[parameters('tags')]",
-        "environmentResourceId": null
-      },
-      "metadata": {
-        "description": "Optional. The configuration to apply for the Web Server Farm resource."
-      }
-    }
-  },
-  "variables": {
-    "logAnalyticsWorkspaceEnabled": "[coalesce(tryGet(parameters('logAnalyticsWorkspaceConfiguration'), 'enabled'), true())]",
-    "logAnalyticsWorkspaceResourceName": "[coalesce(tryGet(parameters('logAnalyticsWorkspaceConfiguration'), 'name'), format('log-{0}', parameters('solutionPrefix')))]",
-    "existingWorkspaceResourceId": "[coalesce(tryGet(parameters('logAnalyticsWorkspaceConfiguration'), 'existingWorkspaceResourceId'), '')]",
-    "useExistingWorkspace": "[not(equals(variables('existingWorkspaceResourceId'), ''))]",
-    "applicationInsightsEnabled": "[coalesce(tryGet(parameters('applicationInsightsConfiguration'), 'enabled'), true())]",
-    "applicationInsightsResourceName": "[coalesce(tryGet(parameters('applicationInsightsConfiguration'), 'name'), format('appi-{0}', parameters('solutionPrefix')))]",
-    "userAssignedManagedIdentityEnabled": "[coalesce(tryGet(parameters('userAssignedManagedIdentityConfiguration'), 'enabled'), true())]",
-    "userAssignedManagedIdentityResourceName": "[coalesce(tryGet(parameters('userAssignedManagedIdentityConfiguration'), 'name'), format('id-{0}', parameters('solutionPrefix')))]",
-    "networkSecurityGroupBackendEnabled": "[coalesce(tryGet(parameters('networkSecurityGroupBackendConfiguration'), 'enabled'), true())]",
-    "networkSecurityGroupBackendResourceName": "[coalesce(tryGet(parameters('networkSecurityGroupBackendConfiguration'), 'name'), format('nsg-backend-{0}', parameters('solutionPrefix')))]",
-    "networkSecurityGroupContainersEnabled": "[coalesce(tryGet(parameters('networkSecurityGroupContainersConfiguration'), 'enabled'), true())]",
-    "networkSecurityGroupContainersResourceName": "[coalesce(tryGet(parameters('networkSecurityGroupContainersConfiguration'), 'name'), format('nsg-containers-{0}', parameters('solutionPrefix')))]",
-    "networkSecurityGroupBastionEnabled": "[coalesce(tryGet(parameters('networkSecurityGroupBastionConfiguration'), 'enabled'), true())]",
-    "networkSecurityGroupBastionResourceName": "[coalesce(tryGet(parameters('networkSecurityGroupBastionConfiguration'), 'name'), format('nsg-bastion-{0}', parameters('solutionPrefix')))]",
-    "networkSecurityGroupAdministrationEnabled": "[coalesce(tryGet(parameters('networkSecurityGroupAdministrationConfiguration'), 'enabled'), true())]",
-    "networkSecurityGroupAdministrationResourceName": "[coalesce(tryGet(parameters('networkSecurityGroupAdministrationConfiguration'), 'name'), format('nsg-administration-{0}', parameters('solutionPrefix')))]",
-    "virtualNetworkEnabled": "[coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'enabled'), true())]",
-    "virtualNetworkResourceName": "[coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'name'), format('vnet-{0}', parameters('solutionPrefix')))]",
-    "bastionEnabled": "[coalesce(tryGet(parameters('bastionConfiguration'), 'enabled'), true())]",
-    "bastionResourceName": "[coalesce(tryGet(parameters('bastionConfiguration'), 'name'), format('bas-{0}', parameters('solutionPrefix')))]",
-    "virtualMachineEnabled": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'enabled'), true())]",
-    "virtualMachineResourceName": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'name'), format('vm{0}', parameters('solutionPrefix')))]",
-    "openAiSubResource": "account",
-    "openAiPrivateDnsZones": {
-      "privatelink.cognitiveservices.azure.com": "[variables('openAiSubResource')]",
-      "privatelink.openai.azure.com": "[variables('openAiSubResource')]",
-      "privatelink.services.ai.azure.com": "[variables('openAiSubResource')]"
-    },
-    "aiFoundryAiServicesResourceName": "[coalesce(tryGet(parameters('aiFoundryAiServicesConfiguration'), 'name'), format('aisa-{0}', parameters('solutionPrefix')))]",
-    "aiFoundryAIservicesEnabled": "[coalesce(tryGet(parameters('aiFoundryAiServicesConfiguration'), 'enabled'), true())]",
-    "aiFoundryAiServicesModelDeployment": {
-      "format": "OpenAI",
-      "name": "[parameters('gptModelName')]",
-      "version": "[parameters('gptModelVersion')]",
-      "sku": {
-        "name": "[parameters('modelDeploymentType')]",
-        "capacity": "[coalesce(tryGet(parameters('aiFoundryAiServicesConfiguration'), 'modelCapacity'), 50)]"
-      },
-      "raiPolicyName": "Microsoft.Default"
-    },
-    "aiFoundryAiProjectName": "[coalesce(tryGet(parameters('aiFoundryAiProjectConfiguration'), 'name'), format('aifp-{0}', parameters('solutionPrefix')))]",
-    "aiProjectDescription": "AI Foundry Project",
-    "cosmosDbAccountEnabled": "[coalesce(tryGet(parameters('cosmosDbAccountConfiguration'), 'enabled'), true())]",
-    "cosmosDbResourceName": "[coalesce(tryGet(parameters('cosmosDbAccountConfiguration'), 'name'), format('cosmos-{0}', parameters('solutionPrefix')))]",
-    "cosmosDbDatabaseName": "macae",
-    "cosmosDbDatabaseMemoryContainerName": "memory",
-    "containerAppEnvironmentEnabled": "[coalesce(tryGet(parameters('containerAppEnvironmentConfiguration'), 'enabled'), true())]",
-    "containerAppEnvironmentResourceName": "[coalesce(tryGet(parameters('containerAppEnvironmentConfiguration'), 'name'), format('cae-{0}', parameters('solutionPrefix')))]",
-    "containerAppEnabled": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'enabled'), true())]",
-    "containerAppResourceName": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'name'), format('ca-{0}', parameters('solutionPrefix')))]",
-    "webServerFarmEnabled": "[coalesce(tryGet(parameters('webServerFarmConfiguration'), 'enabled'), true())]",
-    "webServerFarmResourceName": "[coalesce(tryGet(parameters('webServerFarmConfiguration'), 'name'), format('asp-{0}', parameters('solutionPrefix')))]",
-    "webSiteEnabled": "[coalesce(tryGet(parameters('webSiteConfiguration'), 'enabled'), true())]",
-    "webSiteName": "[format('app-{0}', parameters('solutionPrefix'))]"
-  },
-  "resources": {
-    "aiServices": {
-      "existing": true,
-      "type": "Microsoft.CognitiveServices/accounts",
-      "apiVersion": "2025-04-01-preview",
-      "name": "[variables('aiFoundryAiServicesResourceName')]",
-      "dependsOn": [
-        "aiFoundryAiServices"
-      ]
-    },
-    "aiFoundryProject": {
-      "type": "Microsoft.CognitiveServices/accounts/projects",
-      "apiVersion": "2025-04-01-preview",
-      "name": "[format('{0}/{1}', variables('aiFoundryAiServicesResourceName'), variables('aiFoundryAiProjectName'))]",
-      "location": "[coalesce(tryGet(parameters('aiFoundryAiProjectConfiguration'), 'location'), parameters('azureOpenAILocation'))]",
-      "identity": {
-        "type": "SystemAssigned"
-      },
-      "properties": {
-        "description": "[variables('aiProjectDescription')]",
-        "displayName": "[variables('aiFoundryAiProjectName')]"
-      },
-      "dependsOn": [
-        "aiFoundryAiServices"
-      ]
-    },
-    "aiUser": {
-      "existing": true,
-      "type": "Microsoft.Authorization/roleDefinitions",
-      "apiVersion": "2022-04-01",
-      "name": "53ca6127-db72-4b80-b1b0-d745d6d5456d"
-    },
-    "aiUserAccessProj": {
-      "type": "Microsoft.Authorization/roleAssignments",
-      "apiVersion": "2022-04-01",
-      "scope": "[format('Microsoft.CognitiveServices/accounts/{0}/projects/{1}', variables('aiFoundryAiServicesResourceName'), variables('aiFoundryAiProjectName'))]",
-      "name": "[guid(take(format('avm.res.app.container-app.{0}', variables('containerAppResourceName')), 64), resourceId('Microsoft.CognitiveServices/accounts/projects', variables('aiFoundryAiServicesResourceName'), variables('aiFoundryAiProjectName')), resourceId('Microsoft.Authorization/roleDefinitions', '53ca6127-db72-4b80-b1b0-d745d6d5456d'))]",
-      "properties": {
-        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '53ca6127-db72-4b80-b1b0-d745d6d5456d')]",
-        "principalId": "[tryGet(tryGet(reference('containerApp').outputs, 'systemAssignedMIPrincipalId'), 'value')]"
-      },
-      "dependsOn": [
-        "aiFoundryProject",
-        "containerApp"
-      ]
-    },
-    "aiUserAccessFoundry": {
-      "type": "Microsoft.Authorization/roleAssignments",
-      "apiVersion": "2022-04-01",
-      "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', variables('aiFoundryAiServicesResourceName'))]",
-      "name": "[guid(take(format('avm.res.app.container-app.{0}', variables('containerAppResourceName')), 64), resourceId('Microsoft.CognitiveServices/accounts', variables('aiFoundryAiServicesResourceName')), resourceId('Microsoft.Authorization/roleDefinitions', '53ca6127-db72-4b80-b1b0-d745d6d5456d'))]",
-      "properties": {
-        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '53ca6127-db72-4b80-b1b0-d745d6d5456d')]",
-        "principalId": "[tryGet(tryGet(reference('containerApp').outputs, 'systemAssignedMIPrincipalId'), 'value')]"
-      },
-      "dependsOn": [
-        "aiFoundryAiServices",
-        "containerApp"
-      ]
-    },
-    "aiDeveloper": {
-      "existing": true,
-      "type": "Microsoft.Authorization/roleDefinitions",
-      "apiVersion": "2022-04-01",
-      "name": "64702f94-c441-49e6-a78b-ef80e0188fee"
-    },
-    "aiDeveloperAccessFoundry": {
-      "type": "Microsoft.Authorization/roleAssignments",
-      "apiVersion": "2022-04-01",
-      "scope": "[format('Microsoft.CognitiveServices/accounts/{0}/projects/{1}', variables('aiFoundryAiServicesResourceName'), variables('aiFoundryAiProjectName'))]",
-      "name": "[guid(take(format('avm.res.app.container-app.{0}', variables('containerAppResourceName')), 64), resourceId('Microsoft.CognitiveServices/accounts', variables('aiFoundryAiServicesResourceName')), resourceId('Microsoft.Authorization/roleDefinitions', '64702f94-c441-49e6-a78b-ef80e0188fee'))]",
-      "properties": {
-        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '64702f94-c441-49e6-a78b-ef80e0188fee')]",
-        "principalId": "[tryGet(tryGet(reference('containerApp').outputs, 'systemAssignedMIPrincipalId'), 'value')]"
-      },
-      "dependsOn": [
-        "aiFoundryAiServices",
-        "aiFoundryProject",
-        "containerApp"
-      ]
-    },
-    "cognitiveServiceOpenAIUser": {
-      "existing": true,
-      "type": "Microsoft.Authorization/roleDefinitions",
-      "apiVersion": "2022-04-01",
-      "name": "5e0bd9bd-7b93-4f28-af87-19fc36ad61bd"
-    },
-    "cognitiveServiceOpenAIUserAccessFoundry": {
-      "type": "Microsoft.Authorization/roleAssignments",
-      "apiVersion": "2022-04-01",
-      "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', variables('aiFoundryAiServicesResourceName'))]",
-      "name": "[guid(take(format('avm.res.app.container-app.{0}', variables('containerAppResourceName')), 64), resourceId('Microsoft.CognitiveServices/accounts', variables('aiFoundryAiServicesResourceName')), resourceId('Microsoft.Authorization/roleDefinitions', '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd'))]",
-      "properties": {
-        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd')]",
-        "principalId": "[tryGet(tryGet(reference('containerApp').outputs, 'systemAssignedMIPrincipalId'), 'value')]"
-      },
-      "dependsOn": [
-        "aiFoundryAiServices",
-        "containerApp"
-      ]
-    },
-    "logAnalyticsWorkspace": {
-      "condition": "[and(variables('logAnalyticsWorkspaceEnabled'), not(variables('useExistingWorkspace')))]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2022-09-01",
-      "name": "[take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[variables('logAnalyticsWorkspaceResourceName')]"
-          },
-          "tags": {
-            "value": "[coalesce(tryGet(parameters('logAnalyticsWorkspaceConfiguration'), 'tags'), parameters('tags'))]"
-          },
-          "location": {
-            "value": "[coalesce(tryGet(parameters('logAnalyticsWorkspaceConfiguration'), 'location'), parameters('solutionLocation'))]"
-          },
-          "enableTelemetry": {
-            "value": "[parameters('enableTelemetry')]"
-          },
-          "skuName": {
-            "value": "[coalesce(tryGet(parameters('logAnalyticsWorkspaceConfiguration'), 'sku'), 'PerGB2018')]"
-          },
-          "dataRetention": {
-            "value": "[coalesce(tryGet(parameters('logAnalyticsWorkspaceConfiguration'), 'dataRetentionInDays'), 365)]"
-          },
-          "diagnosticSettings": {
-            "value": [
-              {
-                "useThisWorkspace": true
-              }
-            ]
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.35.1.17967",
-              "templateHash": "10549387460031423688"
-            },
-            "name": "Log Analytics Workspaces",
-            "description": "This module deploys a Log Analytics Workspace."
-          },
-          "definitions": {
-            "diagnosticSettingType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of diagnostic setting."
-                  }
-                },
-                "logCategoriesAndGroups": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                        }
-                      },
-                      "categoryGroup": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                        }
-                      },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                  }
-                },
-                "metricCategories": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                        }
-                      },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                  }
-                },
-                "logAnalyticsDestinationType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "AzureDiagnostics",
-                    "Dedicated"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                  }
-                },
-                "useThisWorkspace": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Instead of using an external reference, use the deployed instance as the target for its diagnostic settings. If set to `true`, the `workspaceResourceId` property is ignored."
-                  }
-                },
-                "workspaceResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "storageAccountResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "eventHubAuthorizationRuleResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                  }
-                },
-                "eventHubName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "marketplacePartnerResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                  }
-                }
-              }
-            },
-            "gallerySolutionType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Name of the solution.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, the name should be in the pattern: `SolutionType[WorkspaceName]`, for example `MySolution[contoso-Logs]`.\nThe solution type is case-sensitive."
-                  }
-                },
-                "plan": {
-                  "$ref": "#/definitions/solutionPlanType",
-                  "metadata": {
-                    "description": "Required. Plan for solution object supported by the OperationsManagement resource provider."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "Properties of the gallery solutions to be created in the log analytics workspace."
-              }
-            },
-            "storageInsightsConfigType": {
-              "type": "object",
-              "properties": {
-                "storageAccountResourceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Resource ID of the storage account to be linked."
-                  }
-                },
-                "containers": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The names of the blob containers that the workspace should read."
-                  }
-                },
-                "tables": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. List of tables to be read by the workspace."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "Properties of the storage insights configuration."
-              }
-            },
-            "linkedServiceType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Name of the linked service."
-                  }
-                },
-                "resourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource id of the resource that will be linked to the workspace. This should be used for linking resources which require read access."
-                  }
-                },
-                "writeAccessResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource id of the resource that will be linked to the workspace. This should be used for linking resources which require write access."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "Properties of the linked service."
-              }
-            },
-            "linkedStorageAccountType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Name of the link."
-                  }
-                },
-                "storageAccountIds": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "minLength": 1,
-                  "metadata": {
-                    "description": "Required. Linked storage accounts resources Ids."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "Properties of the linked storage account."
-              }
-            },
-            "savedSearchType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Name of the saved search."
-                  }
-                },
-                "etag": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The ETag of the saved search. To override an existing saved search, use \"*\" or specify the current Etag."
-                  }
-                },
-                "category": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The category of the saved search. This helps the user to find a saved search faster."
-                  }
-                },
-                "displayName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Display name for the search."
-                  }
-                },
-                "functionAlias": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The function alias if query serves as a function."
-                  }
-                },
-                "functionParameters": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The optional function parameters if query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax please refer to /azure/kusto/query/functions/user-defined-functions."
-                  }
-                },
-                "query": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The query expression for the saved search."
-                  }
-                },
-                "tags": {
-                  "type": "array",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The tags attached to the saved search."
-                  }
-                },
-                "version": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The version number of the query language. The current version is 2 and is the default."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "Properties of the saved search."
-              }
-            },
-            "dataExportType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Name of the data export."
-                  }
-                },
-                "destination": {
-                  "$ref": "#/definitions/destinationType",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The destination of the data export."
-                  }
-                },
-                "enable": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Enable or disable the data export."
-                  }
-                },
-                "tableNames": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "metadata": {
-                    "description": "Required. The list of table names to export."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "Properties of the data export."
-              }
-            },
-            "dataSourceType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Name of the data source."
-                  }
-                },
-                "kind": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The kind of data source."
-                  }
-                },
-                "linkedResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource id of the resource that will be linked to the workspace."
-                  }
-                },
-                "eventLogName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the event log to configure when kind is WindowsEvent."
-                  }
-                },
-                "eventTypes": {
-                  "type": "array",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The event types to configure when kind is WindowsEvent."
-                  }
-                },
-                "objectName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Name of the object to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
-                  }
-                },
-                "instanceName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Name of the instance to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
-                  }
-                },
-                "intervalSeconds": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Interval in seconds to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
-                  }
-                },
-                "performanceCounters": {
-                  "type": "array",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. List of counters to configure when the kind is LinuxPerformanceObject."
-                  }
-                },
-                "counterName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Counter name to configure when kind is WindowsPerformanceCounter."
-                  }
-                },
-                "state": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. State to configure when kind is IISLogs or LinuxSyslogCollection or LinuxPerformanceCollection."
-                  }
-                },
-                "syslogName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. System log to configure when kind is LinuxSyslog."
-                  }
-                },
-                "syslogSeverities": {
-                  "type": "array",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Severities to configure when kind is LinuxSyslog."
-                  }
-                },
-                "tags": {
-                  "type": "object",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Tags to configure in the resource."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "Properties of the data source."
-              }
-            },
-            "tableType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the table."
-                  }
-                },
-                "plan": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The plan for the table."
-                  }
-                },
-                "restoredLogs": {
-                  "$ref": "#/definitions/restoredLogsType",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The restored logs for the table."
-                  }
-                },
-                "schema": {
-                  "$ref": "#/definitions/schemaType",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The schema for the table."
-                  }
-                },
-                "searchResults": {
-                  "$ref": "#/definitions/searchResultsType",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The search results for the table."
-                  }
-                },
-                "retentionInDays": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The retention in days for the table."
-                  }
-                },
-                "totalRetentionInDays": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The total retention in days for the table."
-                  }
-                },
-                "roleAssignments": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/roleAssignmentType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The role assignments for the table."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "Properties of the custom table."
-              }
-            },
-            "workspaceFeaturesType": {
-              "type": "object",
-              "properties": {
-                "disableLocalAuth": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Disable Non-EntraID based Auth. Default is true."
-                  }
-                },
-                "enableDataExport": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Flag that indicate if data should be exported."
-                  }
-                },
-                "enableLogAccessUsingOnlyResourcePermissions": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Enable log access using only resource permissions. Default is false."
-                  }
-                },
-                "immediatePurgeDataOn30Days": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Flag that describes if we want to remove the data after 30 days."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "Features of the workspace."
-              }
-            },
-            "_1.columnType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The column name."
-                  }
-                },
-                "type": {
-                  "type": "string",
-                  "allowedValues": [
-                    "boolean",
-                    "dateTime",
-                    "dynamic",
-                    "guid",
-                    "int",
-                    "long",
-                    "real",
-                    "string"
-                  ],
-                  "metadata": {
-                    "description": "Required. The column type."
-                  }
-                },
-                "dataTypeHint": {
-                  "type": "string",
-                  "allowedValues": [
-                    "armPath",
-                    "guid",
-                    "ip",
-                    "uri"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The column data type logical hint."
-                  }
-                },
-                "description": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The column description."
-                  }
-                },
-                "displayName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Column display name."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "The parameters of the table column.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "table/main.bicep"
-                }
-              }
-            },
-            "destinationType": {
-              "type": "object",
-              "properties": {
-                "resourceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The destination resource ID."
-                  }
-                },
-                "metaData": {
-                  "type": "object",
-                  "properties": {
-                    "eventHubName": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Allows to define an Event Hub name. Not applicable when destination is Storage Account."
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The destination metadata."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "The data export destination properties.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "data-export/main.bicep"
-                }
-              }
-            },
-            "lockType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of lock."
-                  }
-                },
-                "kind": {
-                  "type": "string",
-                  "allowedValues": [
-                    "CanNotDelete",
-                    "None",
-                    "ReadOnly"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a lock.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
-                }
-              }
-            },
-            "managedIdentityAllType": {
-              "type": "object",
-              "properties": {
-                "systemAssigned": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Enables system assigned managed identity on the resource."
-                  }
-                },
-                "userAssignedResourceIds": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
-                }
-              }
-            },
-            "restoredLogsType": {
-              "type": "object",
-              "properties": {
-                "sourceTable": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The table to restore data from."
-                  }
-                },
-                "startRestoreTime": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The timestamp to start the restore from (UTC)."
-                  }
-                },
-                "endRestoreTime": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The timestamp to end the restore by (UTC)."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "The parameters of the restore operation that initiated the table.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "table/main.bicep"
-                }
-              }
-            },
-            "roleAssignmentType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                  }
-                },
-                "roleDefinitionIdOrName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                  }
-                },
-                "principalId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                  }
-                },
-                "principalType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Device",
-                    "ForeignGroup",
-                    "Group",
-                    "ServicePrincipal",
-                    "User"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The principal type of the assigned principal ID."
-                  }
-                },
-                "description": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The description of the role assignment."
-                  }
-                },
-                "condition": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                  }
-                },
-                "conditionVersion": {
-                  "type": "string",
-                  "allowedValues": [
-                    "2.0"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Version of the condition."
-                  }
-                },
-                "delegatedManagedIdentityResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a role assignment.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
-                }
-              }
-            },
-            "schemaType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The table name."
-                  }
-                },
-                "columns": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/_1.columnType"
-                  },
-                  "metadata": {
-                    "description": "Required. A list of table custom columns."
-                  }
-                },
-                "description": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The table description."
-                  }
-                },
-                "displayName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The table display name."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "The table schema.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "table/main.bicep"
-                }
-              }
-            },
-            "searchResultsType": {
-              "type": "object",
-              "properties": {
-                "query": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The search job query."
-                  }
-                },
-                "description": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The search description."
-                  }
-                },
-                "limit": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Limit the search job to return up to specified number of rows."
-                  }
-                },
-                "startSearchTime": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The timestamp to start the search from (UTC)."
-                  }
-                },
-                "endSearchTime": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The timestamp to end the search by (UTC)."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "The parameters of the search job that initiated the table.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "table/main.bicep"
-                }
-              }
-            },
-            "solutionPlanType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Name of the solution to be created.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, it can be anything.\nThe solution type is case-sensitive.\nIf not provided, the value of the `name` parameter will be used."
-                  }
-                },
-                "product": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The product name of the deployed solution.\nFor Microsoft published gallery solution it should be `OMSGallery/{solutionType}`, for example `OMSGallery/AntiMalware`.\nFor a third party solution, it can be anything.\nThis is case sensitive."
-                  }
-                },
-                "publisher": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The publisher name of the deployed solution. For Microsoft published gallery solution, it is `Microsoft`, which is the default value."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/operations-management/solution:0.3.0"
-                }
-              }
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. Name of the Log Analytics workspace."
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional. Location for all resources."
-              }
-            },
-            "skuName": {
-              "type": "string",
-              "defaultValue": "PerGB2018",
-              "allowedValues": [
-                "CapacityReservation",
-                "Free",
-                "LACluster",
-                "PerGB2018",
-                "PerNode",
-                "Premium",
-                "Standalone",
-                "Standard"
-              ],
-              "metadata": {
-                "description": "Optional. The name of the SKU."
-              }
-            },
-            "skuCapacityReservationLevel": {
-              "type": "int",
-              "defaultValue": 100,
-              "minValue": 100,
-              "maxValue": 5000,
-              "metadata": {
-                "description": "Optional. The capacity reservation level in GB for this workspace, when CapacityReservation sku is selected. Must be in increments of 100 between 100 and 5000."
-              }
-            },
-            "storageInsightsConfigs": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/storageInsightsConfigType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. List of storage accounts to be read by the workspace."
-              }
-            },
-            "linkedServices": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/linkedServiceType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. List of services to be linked."
-              }
-            },
-            "linkedStorageAccounts": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/linkedStorageAccountType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Conditional. List of Storage Accounts to be linked. Required if 'forceCmkForQuery' is set to 'true' and 'savedSearches' is not empty."
-              }
-            },
-            "savedSearches": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/savedSearchType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Kusto Query Language searches to save."
-              }
-            },
-            "dataExports": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/dataExportType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. LAW data export instances to be deployed."
-              }
-            },
-            "dataSources": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/dataSourceType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. LAW data sources to configure."
-              }
-            },
-            "tables": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/tableType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. LAW custom tables to be deployed."
-              }
-            },
-            "gallerySolutions": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/gallerySolutionType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. List of gallerySolutions to be created in the log analytics workspace."
-              }
-            },
-            "onboardWorkspaceToSentinel": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Onboard the Log Analytics Workspace to Sentinel. Requires 'SecurityInsights' solution to be in gallerySolutions."
-              }
-            },
-            "dataRetention": {
-              "type": "int",
-              "defaultValue": 365,
-              "minValue": 0,
-              "maxValue": 730,
-              "metadata": {
-                "description": "Optional. Number of days data will be retained for."
-              }
-            },
-            "dailyQuotaGb": {
-              "type": "int",
-              "defaultValue": -1,
-              "minValue": -1,
-              "metadata": {
-                "description": "Optional. The workspace daily quota for ingestion."
-              }
-            },
-            "publicNetworkAccessForIngestion": {
-              "type": "string",
-              "defaultValue": "Enabled",
-              "allowedValues": [
-                "Enabled",
-                "Disabled"
-              ],
-              "metadata": {
-                "description": "Optional. The network access type for accessing Log Analytics ingestion."
-              }
-            },
-            "publicNetworkAccessForQuery": {
-              "type": "string",
-              "defaultValue": "Enabled",
-              "allowedValues": [
-                "Enabled",
-                "Disabled"
-              ],
-              "metadata": {
-                "description": "Optional. The network access type for accessing Log Analytics query."
-              }
-            },
-            "managedIdentities": {
-              "$ref": "#/definitions/managedIdentityAllType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The managed identity definition for this resource. Only one type of identity is supported: system-assigned or user-assigned, but not both."
-              }
-            },
-            "features": {
-              "$ref": "#/definitions/workspaceFeaturesType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The workspace features."
-              }
-            },
-            "diagnosticSettings": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/diagnosticSettingType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The diagnostic settings of the service."
-              }
-            },
-            "forceCmkForQuery": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Indicates whether customer managed storage is mandatory for query management."
-              }
-            },
-            "lock": {
-              "$ref": "#/definitions/lockType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The lock settings of the service."
-              }
-            },
-            "roleAssignments": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/roleAssignmentType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of role assignments to create."
-              }
-            },
-            "tags": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Tags of the resource."
-              }
-            },
-            "enableTelemetry": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Enable/Disable usage telemetry for module."
-              }
-            }
-          },
-          "variables": {
-            "copy": [
-              {
-                "name": "formattedRoleAssignments",
-                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-              }
-            ],
-            "enableReferencedModulesTelemetry": false,
-            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), 'SystemAssigned', if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
-            "builtInRoleNames": {
-              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-              "Log Analytics Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '92aaf0da-9dab-42b6-94a3-d43ce8d16293')]",
-              "Log Analytics Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '73c42c96-874c-492b-b04d-ab87d138a893')]",
-              "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]",
-              "Monitoring Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '43d0d8ad-25c7-4714-9337-8ba259a9fe05')]",
-              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-              "Security Admin": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fb1c8493-542b-48eb-b624-b4c8fea62acd')]",
-              "Security Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '39bc4728-0917-49c7-9d2c-d95423bc2eb4')]",
-              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-            }
-          },
-          "resources": {
-            "avmTelemetry": {
-              "condition": "[parameters('enableTelemetry')]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.operationalinsights-workspace.{0}.{1}', replace('0.11.2', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-              "properties": {
-                "mode": "Incremental",
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "resources": [],
-                  "outputs": {
-                    "telemetry": {
-                      "type": "String",
-                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                    }
-                  }
-                }
-              }
-            },
-            "logAnalyticsWorkspace": {
-              "type": "Microsoft.OperationalInsights/workspaces",
-              "apiVersion": "2023-09-01",
-              "name": "[parameters('name')]",
-              "location": "[parameters('location')]",
-              "tags": "[parameters('tags')]",
-              "properties": {
-                "features": {
-                  "searchVersion": 1,
-                  "enableLogAccessUsingOnlyResourcePermissions": "[coalesce(tryGet(parameters('features'), 'enableLogAccessUsingOnlyResourcePermissions'), false())]",
-                  "disableLocalAuth": "[coalesce(tryGet(parameters('features'), 'disableLocalAuth'), true())]",
-                  "enableDataExport": "[tryGet(parameters('features'), 'enableDataExport')]",
-                  "immediatePurgeDataOn30Days": "[tryGet(parameters('features'), 'immediatePurgeDataOn30Days')]"
-                },
-                "sku": {
-                  "name": "[parameters('skuName')]",
-                  "capacityReservationLevel": "[if(equals(parameters('skuName'), 'CapacityReservation'), parameters('skuCapacityReservationLevel'), null())]"
-                },
-                "retentionInDays": "[parameters('dataRetention')]",
-                "workspaceCapping": {
-                  "dailyQuotaGb": "[parameters('dailyQuotaGb')]"
-                },
-                "publicNetworkAccessForIngestion": "[parameters('publicNetworkAccessForIngestion')]",
-                "publicNetworkAccessForQuery": "[parameters('publicNetworkAccessForQuery')]",
-                "forceCmkForQuery": "[parameters('forceCmkForQuery')]"
-              },
-              "identity": "[variables('identity')]"
-            },
-            "logAnalyticsWorkspace_diagnosticSettings": {
-              "copy": {
-                "name": "logAnalyticsWorkspace_diagnosticSettings",
-                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-              },
-              "type": "Microsoft.Insights/diagnosticSettings",
-              "apiVersion": "2021-05-01-preview",
-              "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-              "properties": {
-                "copy": [
-                  {
-                    "name": "metrics",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                    "input": {
-                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                      "timeGrain": null
-                    }
-                  },
-                  {
-                    "name": "logs",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                    "input": {
-                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                    }
-                  }
-                ],
-                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                "workspaceId": "[if(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'useThisWorkspace'), false()), resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId'))]",
-                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-              },
-              "dependsOn": [
-                "logAnalyticsWorkspace"
-              ]
-            },
-            "logAnalyticsWorkspace_sentinelOnboarding": {
-              "condition": "[and(not(empty(filter(coalesce(parameters('gallerySolutions'), createArray()), lambda('item', startsWith(lambdaVariables('item').name, 'SecurityInsights'))))), parameters('onboardWorkspaceToSentinel'))]",
-              "type": "Microsoft.SecurityInsights/onboardingStates",
-              "apiVersion": "2024-03-01",
-              "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
-              "name": "default",
-              "properties": {},
-              "dependsOn": [
-                "logAnalyticsWorkspace"
-              ]
-            },
-            "logAnalyticsWorkspace_lock": {
-              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-              "type": "Microsoft.Authorization/locks",
-              "apiVersion": "2020-05-01",
-              "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-              "properties": {
-                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-              },
-              "dependsOn": [
-                "logAnalyticsWorkspace"
-              ]
-            },
-            "logAnalyticsWorkspace_roleAssignments": {
-              "copy": {
-                "name": "logAnalyticsWorkspace_roleAssignments",
-                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-              },
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-              "properties": {
-                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-              },
-              "dependsOn": [
-                "logAnalyticsWorkspace"
-              ]
-            },
-            "logAnalyticsWorkspace_storageInsightConfigs": {
-              "copy": {
-                "name": "logAnalyticsWorkspace_storageInsightConfigs",
-                "count": "[length(coalesce(parameters('storageInsightsConfigs'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-LAW-StorageInsightsConfig-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "logAnalyticsWorkspaceName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "containers": {
-                    "value": "[tryGet(coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()], 'containers')]"
-                  },
-                  "tables": {
-                    "value": "[tryGet(coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()], 'tables')]"
-                  },
-                  "storageAccountResourceId": {
-                    "value": "[coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()].storageAccountResourceId]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.35.1.17967",
-                      "templateHash": "2043978404537017691"
-                    },
-                    "name": "Log Analytics Workspace Storage Insight Configs",
-                    "description": "This module deploys a Log Analytics Workspace Storage Insight Config."
-                  },
-                  "parameters": {
-                    "logAnalyticsWorkspaceName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "defaultValue": "[format('{0}-stinsconfig', last(split(parameters('storageAccountResourceId'), '/')))]",
-                      "metadata": {
-                        "description": "Optional. The name of the storage insights config."
-                      }
-                    },
-                    "storageAccountResourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The Azure Resource Manager ID of the storage account resource."
-                      }
-                    },
-                    "containers": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The names of the blob containers that the workspace should read."
-                      }
-                    },
-                    "tables": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The names of the Azure tables that the workspace should read."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags to configure in the resource."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "storageAccount": {
-                      "existing": true,
-                      "type": "Microsoft.Storage/storageAccounts",
-                      "apiVersion": "2022-09-01",
-                      "name": "[last(split(parameters('storageAccountResourceId'), '/'))]"
-                    },
-                    "workspace": {
-                      "existing": true,
-                      "type": "Microsoft.OperationalInsights/workspaces",
-                      "apiVersion": "2023-09-01",
-                      "name": "[parameters('logAnalyticsWorkspaceName')]"
-                    },
-                    "storageinsightconfig": {
-                      "type": "Microsoft.OperationalInsights/workspaces/storageInsightConfigs",
-                      "apiVersion": "2023-09-01",
-                      "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "containers": "[parameters('containers')]",
-                        "tables": "[parameters('tables')]",
-                        "storageAccount": {
-                          "id": "[parameters('storageAccountResourceId')]",
-                          "key": "[listKeys('storageAccount', '2022-09-01').keys[0].value]"
-                        }
-                      }
-                    }
-                  },
-                  "outputs": {
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed storage insights configuration."
-                      },
-                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces/storageInsightConfigs', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group where the storage insight configuration is deployed."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the storage insights configuration."
-                      },
-                      "value": "[parameters('name')]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "logAnalyticsWorkspace"
-              ]
-            },
-            "logAnalyticsWorkspace_linkedServices": {
-              "copy": {
-                "name": "logAnalyticsWorkspace_linkedServices",
-                "count": "[length(coalesce(parameters('linkedServices'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-LAW-LinkedService-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "logAnalyticsWorkspaceName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(parameters('linkedServices'), createArray())[copyIndex()].name]"
-                  },
-                  "resourceId": {
-                    "value": "[tryGet(coalesce(parameters('linkedServices'), createArray())[copyIndex()], 'resourceId')]"
-                  },
-                  "writeAccessResourceId": {
-                    "value": "[tryGet(coalesce(parameters('linkedServices'), createArray())[copyIndex()], 'writeAccessResourceId')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.35.1.17967",
-                      "templateHash": "15624488954958814427"
-                    },
-                    "name": "Log Analytics Workspace Linked Services",
-                    "description": "This module deploys a Log Analytics Workspace Linked Service."
-                  },
-                  "parameters": {
-                    "logAnalyticsWorkspaceName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the link."
-                      }
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The resource ID of the resource that will be linked to the workspace. This should be used for linking resources which require read access."
-                      }
-                    },
-                    "writeAccessResourceId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The resource ID of the resource that will be linked to the workspace. This should be used for linking resources which require write access."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags to configure in the resource."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "workspace": {
-                      "existing": true,
-                      "type": "Microsoft.OperationalInsights/workspaces",
-                      "apiVersion": "2023-09-01",
-                      "name": "[parameters('logAnalyticsWorkspaceName')]"
-                    },
-                    "linkedService": {
-                      "type": "Microsoft.OperationalInsights/workspaces/linkedServices",
-                      "apiVersion": "2023-09-01",
-                      "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "resourceId": "[parameters('resourceId')]",
-                        "writeAccessResourceId": "[parameters('writeAccessResourceId')]"
-                      }
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed linked service."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed linked service."
-                      },
-                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces/linkedServices', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group where the linked service is deployed."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "logAnalyticsWorkspace"
-              ]
-            },
-            "logAnalyticsWorkspace_linkedStorageAccounts": {
-              "copy": {
-                "name": "logAnalyticsWorkspace_linkedStorageAccounts",
-                "count": "[length(coalesce(parameters('linkedStorageAccounts'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-LAW-LinkedStorageAccount-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "logAnalyticsWorkspaceName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(parameters('linkedStorageAccounts'), createArray())[copyIndex()].name]"
-                  },
-                  "storageAccountIds": {
-                    "value": "[coalesce(parameters('linkedStorageAccounts'), createArray())[copyIndex()].storageAccountIds]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.35.1.17967",
-                      "templateHash": "8250559094478594611"
-                    },
-                    "name": "Log Analytics Workspace Linked Storage Accounts",
-                    "description": "This module deploys a Log Analytics Workspace Linked Storage Account."
-                  },
-                  "parameters": {
-                    "logAnalyticsWorkspaceName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "allowedValues": [
-                        "Query",
-                        "Alerts",
-                        "CustomLogs",
-                        "AzureWatson"
-                      ],
-                      "metadata": {
-                        "description": "Required. Name of the link."
-                      }
-                    },
-                    "storageAccountIds": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "minLength": 1,
-                      "metadata": {
-                        "description": "Required. Linked storage accounts resources Ids."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "workspace": {
-                      "existing": true,
-                      "type": "Microsoft.OperationalInsights/workspaces",
-                      "apiVersion": "2023-09-01",
-                      "name": "[parameters('logAnalyticsWorkspaceName')]"
-                    },
-                    "linkedStorageAccount": {
-                      "type": "Microsoft.OperationalInsights/workspaces/linkedStorageAccounts",
-                      "apiVersion": "2023-09-01",
-                      "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
-                      "properties": {
-                        "storageAccountIds": "[parameters('storageAccountIds')]"
-                      }
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed linked storage account."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed linked storage account."
-                      },
-                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces/linkedStorageAccounts', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group where the linked storage account is deployed."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "logAnalyticsWorkspace"
-              ]
-            },
-            "logAnalyticsWorkspace_savedSearches": {
-              "copy": {
-                "name": "logAnalyticsWorkspace_savedSearches",
-                "count": "[length(coalesce(parameters('savedSearches'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-LAW-SavedSearch-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "logAnalyticsWorkspaceName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[format('{0}{1}', coalesce(parameters('savedSearches'), createArray())[copyIndex()].name, uniqueString(deployment().name))]"
-                  },
-                  "etag": {
-                    "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'etag')]"
-                  },
-                  "displayName": {
-                    "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].displayName]"
-                  },
-                  "category": {
-                    "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].category]"
-                  },
-                  "query": {
-                    "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].query]"
-                  },
-                  "functionAlias": {
-                    "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'functionAlias')]"
-                  },
-                  "functionParameters": {
-                    "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'functionParameters')]"
-                  },
-                  "tags": {
-                    "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'tags')]"
-                  },
-                  "version": {
-                    "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'version')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.35.1.17967",
-                      "templateHash": "5149844663841891327"
-                    },
-                    "name": "Log Analytics Workspace Saved Searches",
-                    "description": "This module deploys a Log Analytics Workspace Saved Search."
-                  },
-                  "parameters": {
-                    "logAnalyticsWorkspaceName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the saved search."
-                      }
-                    },
-                    "displayName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Display name for the search."
-                      }
-                    },
-                    "category": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Query category."
-                      }
-                    },
-                    "query": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Kusto Query to be stored."
-                      }
-                    },
-                    "tags": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags to configure in the resource."
-                      }
-                    },
-                    "functionAlias": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. The function alias if query serves as a function."
-                      }
-                    },
-                    "functionParameters": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. The optional function parameters if query serves as a function. Value should be in the following format: \"param-name1:type1 = default_value1, param-name2:type2 = default_value2\". For more examples and proper syntax please refer to /azure/kusto/query/functions/user-defined-functions."
-                      }
-                    },
-                    "version": {
-                      "type": "int",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The version number of the query language."
-                      }
-                    },
-                    "etag": {
-                      "type": "string",
-                      "defaultValue": "*",
-                      "metadata": {
-                        "description": "Optional. The ETag of the saved search. To override an existing saved search, use \"*\" or specify the current Etag."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "workspace": {
-                      "existing": true,
-                      "type": "Microsoft.OperationalInsights/workspaces",
-                      "apiVersion": "2023-09-01",
-                      "name": "[parameters('logAnalyticsWorkspaceName')]"
-                    },
-                    "savedSearch": {
-                      "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
-                      "apiVersion": "2023-09-01",
-                      "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
-                      "properties": {
-                        "etag": "[parameters('etag')]",
-                        "tags": "[coalesce(parameters('tags'), createArray())]",
-                        "displayName": "[parameters('displayName')]",
-                        "category": "[parameters('category')]",
-                        "query": "[parameters('query')]",
-                        "functionAlias": "[parameters('functionAlias')]",
-                        "functionParameters": "[parameters('functionParameters')]",
-                        "version": "[parameters('version')]"
-                      }
-                    }
-                  },
-                  "outputs": {
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed saved search."
-                      },
-                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group where the saved search is deployed."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed saved search."
-                      },
-                      "value": "[parameters('name')]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "logAnalyticsWorkspace",
-                "logAnalyticsWorkspace_linkedStorageAccounts"
-              ]
-            },
-            "logAnalyticsWorkspace_dataExports": {
-              "copy": {
-                "name": "logAnalyticsWorkspace_dataExports",
-                "count": "[length(coalesce(parameters('dataExports'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-LAW-DataExport-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "workspaceName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(parameters('dataExports'), createArray())[copyIndex()].name]"
-                  },
-                  "destination": {
-                    "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'destination')]"
-                  },
-                  "enable": {
-                    "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'enable')]"
-                  },
-                  "tableNames": {
-                    "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'tableNames')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.35.1.17967",
-                      "templateHash": "1695158270142527557"
-                    },
-                    "name": "Log Analytics Workspace Data Exports",
-                    "description": "This module deploys a Log Analytics Workspace Data Export."
-                  },
-                  "definitions": {
-                    "destinationType": {
-                      "type": "object",
-                      "properties": {
-                        "resourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The destination resource ID."
-                          }
-                        },
-                        "metaData": {
-                          "type": "object",
-                          "properties": {
-                            "eventHubName": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Allows to define an Event Hub name. Not applicable when destination is Storage Account."
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The destination metadata."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The data export destination properties."
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "minLength": 4,
-                      "maxLength": 63,
-                      "metadata": {
-                        "description": "Required. The data export rule name."
-                      }
-                    },
-                    "workspaceName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent workspaces. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "destination": {
-                      "$ref": "#/definitions/destinationType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Destination properties."
-                      }
-                    },
-                    "enable": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Active when enabled."
-                      }
-                    },
-                    "tableNames": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "minLength": 1,
-                      "metadata": {
-                        "description": "Required. An array of tables to export, for example: ['Heartbeat', 'SecurityEvent']."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "workspace": {
-                      "existing": true,
-                      "type": "Microsoft.OperationalInsights/workspaces",
-                      "apiVersion": "2023-09-01",
-                      "name": "[parameters('workspaceName')]"
-                    },
-                    "dataExport": {
-                      "type": "Microsoft.OperationalInsights/workspaces/dataExports",
-                      "apiVersion": "2023-09-01",
-                      "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('name'))]",
-                      "properties": {
-                        "destination": "[parameters('destination')]",
-                        "enable": "[parameters('enable')]",
-                        "tableNames": "[parameters('tableNames')]"
-                      }
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the data export."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the data export."
-                      },
-                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces/dataExports', parameters('workspaceName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the resource group the data export was created in."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "logAnalyticsWorkspace"
-              ]
-            },
-            "logAnalyticsWorkspace_dataSources": {
-              "copy": {
-                "name": "logAnalyticsWorkspace_dataSources",
-                "count": "[length(coalesce(parameters('dataSources'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-LAW-DataSource-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "logAnalyticsWorkspaceName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(parameters('dataSources'), createArray())[copyIndex()].name]"
-                  },
-                  "kind": {
-                    "value": "[coalesce(parameters('dataSources'), createArray())[copyIndex()].kind]"
-                  },
-                  "linkedResourceId": {
-                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'linkedResourceId')]"
-                  },
-                  "eventLogName": {
-                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'eventLogName')]"
-                  },
-                  "eventTypes": {
-                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'eventTypes')]"
-                  },
-                  "objectName": {
-                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'objectName')]"
-                  },
-                  "instanceName": {
-                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'instanceName')]"
-                  },
-                  "intervalSeconds": {
-                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'intervalSeconds')]"
-                  },
-                  "counterName": {
-                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'counterName')]"
-                  },
-                  "state": {
-                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'state')]"
-                  },
-                  "syslogName": {
-                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'syslogName')]"
-                  },
-                  "syslogSeverities": {
-                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'syslogSeverities')]"
-                  },
-                  "performanceCounters": {
-                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'performanceCounters')]"
-                  },
-                  "tags": {
-                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'tags')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.35.1.17967",
-                      "templateHash": "3062149733782372246"
-                    },
-                    "name": "Log Analytics Workspace Datasources",
-                    "description": "This module deploys a Log Analytics Workspace Data Source."
-                  },
-                  "parameters": {
-                    "logAnalyticsWorkspaceName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the data source."
-                      }
-                    },
-                    "kind": {
-                      "type": "string",
-                      "defaultValue": "AzureActivityLog",
-                      "allowedValues": [
-                        "AzureActivityLog",
-                        "WindowsEvent",
-                        "WindowsPerformanceCounter",
-                        "IISLogs",
-                        "LinuxSyslog",
-                        "LinuxSyslogCollection",
-                        "LinuxPerformanceObject",
-                        "LinuxPerformanceCollection"
-                      ],
-                      "metadata": {
-                        "description": "Optional. The kind of the data source."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags to configure in the resource."
-                      }
-                    },
-                    "linkedResourceId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Resource ID of the resource to be linked."
-                      }
-                    },
-                    "eventLogName": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Windows event log name to configure when kind is WindowsEvent."
-                      }
-                    },
-                    "eventTypes": {
-                      "type": "array",
-                      "defaultValue": [],
-                      "metadata": {
-                        "description": "Optional. Windows event types to configure when kind is WindowsEvent."
-                      }
-                    },
-                    "objectName": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Name of the object to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
-                      }
-                    },
-                    "instanceName": {
-                      "type": "string",
-                      "defaultValue": "*",
-                      "metadata": {
-                        "description": "Optional. Name of the instance to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
-                      }
-                    },
-                    "intervalSeconds": {
-                      "type": "int",
-                      "defaultValue": 60,
-                      "metadata": {
-                        "description": "Optional. Interval in seconds to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
-                      }
-                    },
-                    "performanceCounters": {
-                      "type": "array",
-                      "defaultValue": [],
-                      "metadata": {
-                        "description": "Optional. List of counters to configure when the kind is LinuxPerformanceObject."
-                      }
-                    },
-                    "counterName": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Counter name to configure when kind is WindowsPerformanceCounter."
-                      }
-                    },
-                    "state": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. State to configure when kind is IISLogs or LinuxSyslogCollection or LinuxPerformanceCollection."
-                      }
-                    },
-                    "syslogName": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. System log to configure when kind is LinuxSyslog."
-                      }
-                    },
-                    "syslogSeverities": {
-                      "type": "array",
-                      "defaultValue": [],
-                      "metadata": {
-                        "description": "Optional. Severities to configure when kind is LinuxSyslog."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "workspace": {
-                      "existing": true,
-                      "type": "Microsoft.OperationalInsights/workspaces",
-                      "apiVersion": "2023-09-01",
-                      "name": "[parameters('logAnalyticsWorkspaceName')]"
-                    },
-                    "dataSource": {
-                      "type": "Microsoft.OperationalInsights/workspaces/dataSources",
-                      "apiVersion": "2023-09-01",
-                      "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
-                      "kind": "[parameters('kind')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "linkedResourceId": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'AzureActivityLog')), parameters('linkedResourceId'), null())]",
-                        "eventLogName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsEvent')), parameters('eventLogName'), null())]",
-                        "eventTypes": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsEvent')), parameters('eventTypes'), null())]",
-                        "objectName": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('objectName'), null())]",
-                        "instanceName": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('instanceName'), null())]",
-                        "intervalSeconds": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('intervalSeconds'), null())]",
-                        "counterName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsPerformanceCounter')), parameters('counterName'), null())]",
-                        "state": "[if(and(not(empty(parameters('kind'))), or(or(equals(parameters('kind'), 'IISLogs'), equals(parameters('kind'), 'LinuxSyslogCollection')), equals(parameters('kind'), 'LinuxPerformanceCollection'))), parameters('state'), null())]",
-                        "syslogName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'LinuxSyslog')), parameters('syslogName'), null())]",
-                        "syslogSeverities": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'LinuxSyslog'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('syslogSeverities'), null())]",
-                        "performanceCounters": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'LinuxPerformanceObject')), parameters('performanceCounters'), null())]"
-                      }
-                    }
-                  },
-                  "outputs": {
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed data source."
-                      },
-                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces/dataSources', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group where the data source is deployed."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed data source."
-                      },
-                      "value": "[parameters('name')]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "logAnalyticsWorkspace"
-              ]
-            },
-            "logAnalyticsWorkspace_tables": {
-              "copy": {
-                "name": "logAnalyticsWorkspace_tables",
-                "count": "[length(coalesce(parameters('tables'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-LAW-Table-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "workspaceName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(parameters('tables'), createArray())[copyIndex()].name]"
-                  },
-                  "plan": {
-                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'plan')]"
-                  },
-                  "schema": {
-                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'schema')]"
-                  },
-                  "retentionInDays": {
-                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'retentionInDays')]"
-                  },
-                  "totalRetentionInDays": {
-                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'totalRetentionInDays')]"
-                  },
-                  "restoredLogs": {
-                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'restoredLogs')]"
-                  },
-                  "searchResults": {
-                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'searchResults')]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'roleAssignments')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.35.1.17967",
-                      "templateHash": "5855172714151847939"
-                    },
-                    "name": "Log Analytics Workspace Tables",
-                    "description": "This module deploys a Log Analytics Workspace Table."
-                  },
-                  "definitions": {
-                    "restoredLogsType": {
-                      "type": "object",
-                      "properties": {
-                        "sourceTable": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The table to restore data from."
-                          }
-                        },
-                        "startRestoreTime": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The timestamp to start the restore from (UTC)."
-                          }
-                        },
-                        "endRestoreTime": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The timestamp to end the restore by (UTC)."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The parameters of the restore operation that initiated the table."
-                      }
-                    },
-                    "schemaType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The table name."
-                          }
-                        },
-                        "columns": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/columnType"
-                          },
-                          "metadata": {
-                            "description": "Required. A list of table custom columns."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The table description."
-                          }
-                        },
-                        "displayName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The table display name."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The table schema."
-                      }
-                    },
-                    "columnType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The column name."
-                          }
-                        },
-                        "type": {
-                          "type": "string",
-                          "allowedValues": [
-                            "boolean",
-                            "dateTime",
-                            "dynamic",
-                            "guid",
-                            "int",
-                            "long",
-                            "real",
-                            "string"
-                          ],
-                          "metadata": {
-                            "description": "Required. The column type."
-                          }
-                        },
-                        "dataTypeHint": {
-                          "type": "string",
-                          "allowedValues": [
-                            "armPath",
-                            "guid",
-                            "ip",
-                            "uri"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The column data type logical hint."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The column description."
-                          }
-                        },
-                        "displayName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Column display name."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The parameters of the table column."
-                      }
-                    },
-                    "searchResultsType": {
-                      "type": "object",
-                      "properties": {
-                        "query": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The search job query."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The search description."
-                          }
-                        },
-                        "limit": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Limit the search job to return up to specified number of rows."
-                          }
-                        },
-                        "startSearchTime": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The timestamp to start the search from (UTC)."
-                          }
-                        },
-                        "endSearchTime": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The timestamp to end the search by (UTC)."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The parameters of the search job that initiated the table."
-                      }
-                    },
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the table."
-                      }
-                    },
-                    "workspaceName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent workspaces. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "plan": {
-                      "type": "string",
-                      "defaultValue": "Analytics",
-                      "allowedValues": [
-                        "Basic",
-                        "Analytics"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Instruct the system how to handle and charge the logs ingested to this table."
-                      }
-                    },
-                    "restoredLogs": {
-                      "$ref": "#/definitions/restoredLogsType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Restore parameters."
-                      }
-                    },
-                    "retentionInDays": {
-                      "type": "int",
-                      "defaultValue": -1,
-                      "minValue": -1,
-                      "maxValue": 730,
-                      "metadata": {
-                        "description": "Optional. The table retention in days, between 4 and 730. Setting this property to -1 will default to the workspace retention."
-                      }
-                    },
-                    "schema": {
-                      "$ref": "#/definitions/schemaType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Table's schema."
-                      }
-                    },
-                    "searchResults": {
-                      "$ref": "#/definitions/searchResultsType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Parameters of the search job that initiated this table."
-                      }
-                    },
-                    "totalRetentionInDays": {
-                      "type": "int",
-                      "defaultValue": -1,
-                      "minValue": -1,
-                      "maxValue": 2555,
-                      "metadata": {
-                        "description": "Optional. The table total retention in days, between 4 and 2555. Setting this property to -1 will default to table retention."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Log Analytics Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '92aaf0da-9dab-42b6-94a3-d43ce8d16293')]",
-                      "Log Analytics Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '73c42c96-874c-492b-b04d-ab87d138a893')]",
-                      "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]",
-                      "Monitoring Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '43d0d8ad-25c7-4714-9337-8ba259a9fe05')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "workspace": {
-                      "existing": true,
-                      "type": "Microsoft.OperationalInsights/workspaces",
-                      "apiVersion": "2023-09-01",
-                      "name": "[parameters('workspaceName')]"
-                    },
-                    "table": {
-                      "type": "Microsoft.OperationalInsights/workspaces/tables",
-                      "apiVersion": "2023-09-01",
-                      "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('name'))]",
-                      "properties": {
-                        "plan": "[parameters('plan')]",
-                        "restoredLogs": "[parameters('restoredLogs')]",
-                        "retentionInDays": "[parameters('retentionInDays')]",
-                        "schema": "[parameters('schema')]",
-                        "searchResults": "[parameters('searchResults')]",
-                        "totalRetentionInDays": "[parameters('totalRetentionInDays')]"
-                      }
-                    },
-                    "table_roleAssignments": {
-                      "copy": {
-                        "name": "table_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}/tables/{1}', parameters('workspaceName'), parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "table"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the table."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the table."
-                      },
-                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the resource group the table was created in."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "logAnalyticsWorkspace"
-              ]
-            },
-            "logAnalyticsWorkspace_solutions": {
-              "copy": {
-                "name": "logAnalyticsWorkspace_solutions",
-                "count": "[length(coalesce(parameters('gallerySolutions'), createArray()))]"
-              },
-              "condition": "[not(empty(parameters('gallerySolutions')))]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-LAW-Solution-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[coalesce(parameters('gallerySolutions'), createArray())[copyIndex()].name]"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "logAnalyticsWorkspaceName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "plan": {
-                    "value": "[coalesce(parameters('gallerySolutions'), createArray())[copyIndex()].plan]"
-                  },
-                  "enableTelemetry": {
-                    "value": "[variables('enableReferencedModulesTelemetry')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.30.23.60470",
-                      "templateHash": "1867653058254938383"
-                    },
-                    "name": "Operations Management Solutions",
-                    "description": "This module deploys an Operations Management Solution.",
-                    "owner": "Azure/module-maintainers"
-                  },
-                  "definitions": {
-                    "solutionPlanType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of the solution to be created.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, it can be anything.\nThe solution type is case-sensitive.\nIf not provided, the value of the `name` parameter will be used."
-                          }
-                        },
-                        "product": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The product name of the deployed solution.\nFor Microsoft published gallery solution it should be `OMSGallery/{solutionType}`, for example `OMSGallery/AntiMalware`.\nFor a third party solution, it can be anything.\nThis is case sensitive."
-                          }
-                        },
-                        "publisher": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The publisher name of the deployed solution. For Microsoft published gallery solution, it is `Microsoft`, which is the default value."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the solution.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, the name should be in the pattern: `SolutionType[WorkspaceName]`, for example `MySolution[contoso-Logs]`.\nThe solution type is case-sensitive."
-                      }
-                    },
-                    "plan": {
-                      "$ref": "#/definitions/solutionPlanType",
-                      "metadata": {
-                        "description": "Required. Plan for solution object supported by the OperationsManagement resource provider."
-                      }
-                    },
-                    "logAnalyticsWorkspaceName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the Log Analytics workspace where the solution will be deployed/enabled."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all resources."
-                      }
-                    },
-                    "enableTelemetry": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Enable/Disable usage telemetry for module."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "avmTelemetry": {
-                      "condition": "[parameters('enableTelemetry')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2024-03-01",
-                      "name": "[format('46d3xbcp.res.operationsmanagement-solution.{0}.{1}', replace('0.3.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                      "properties": {
-                        "mode": "Incremental",
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "resources": [],
-                          "outputs": {
-                            "telemetry": {
-                              "type": "String",
-                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "logAnalyticsWorkspace": {
-                      "existing": true,
-                      "type": "Microsoft.OperationalInsights/workspaces",
-                      "apiVersion": "2021-06-01",
-                      "name": "[parameters('logAnalyticsWorkspaceName')]"
-                    },
-                    "solution": {
-                      "type": "Microsoft.OperationsManagement/solutions",
-                      "apiVersion": "2015-11-01-preview",
-                      "name": "[parameters('name')]",
-                      "location": "[parameters('location')]",
-                      "properties": {
-                        "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsWorkspaceName'))]"
-                      },
-                      "plan": {
-                        "name": "[coalesce(tryGet(parameters('plan'), 'name'), parameters('name'))]",
-                        "promotionCode": "",
-                        "product": "[parameters('plan').product]",
-                        "publisher": "[coalesce(tryGet(parameters('plan'), 'publisher'), 'Microsoft')]"
-                      },
-                      "dependsOn": [
-                        "logAnalyticsWorkspace"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed solution."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed solution."
-                      },
-                      "value": "[resourceId('Microsoft.OperationsManagement/solutions', parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group where the solution is deployed."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('solution', '2015-11-01-preview', 'full').location]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "logAnalyticsWorkspace"
-              ]
-            }
-          },
-          "outputs": {
-            "resourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource ID of the deployed log analytics workspace."
-              },
-              "value": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('name'))]"
-            },
-            "resourceGroupName": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource group of the deployed log analytics workspace."
-              },
-              "value": "[resourceGroup().name]"
-            },
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the deployed log analytics workspace."
-              },
-              "value": "[parameters('name')]"
-            },
-            "logAnalyticsWorkspaceId": {
-              "type": "string",
-              "metadata": {
-                "description": "The ID associated with the workspace."
-              },
-              "value": "[reference('logAnalyticsWorkspace').customerId]"
-            },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "The location the resource was deployed into."
-              },
-              "value": "[reference('logAnalyticsWorkspace', '2023-09-01', 'full').location]"
-            },
-            "systemAssignedMIPrincipalId": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "The principal ID of the system assigned identity."
-              },
-              "value": "[tryGet(tryGet(reference('logAnalyticsWorkspace', '2023-09-01', 'full'), 'identity'), 'principalId')]"
-            },
-            "primarySharedKey": {
-              "type": "securestring",
-              "metadata": {
-                "description": "The primary shared key of the log analytics workspace."
-              },
-              "value": "[listKeys('logAnalyticsWorkspace', '2023-09-01').primarySharedKey]"
-            },
-            "secondarySharedKey": {
-              "type": "securestring",
-              "metadata": {
-                "description": "The secondary shared key of the log analytics workspace."
-              },
-              "value": "[listKeys('logAnalyticsWorkspace', '2023-09-01').secondarySharedKey]"
-            }
-          }
-        }
-      }
-    },
-    "applicationInsights": {
-      "condition": "[variables('applicationInsightsEnabled')]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2022-09-01",
-      "name": "[take(format('avm.res.insights.component.{0}', variables('applicationInsightsResourceName')), 64)]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[variables('applicationInsightsResourceName')]"
-          },
-          "workspaceResourceId": "[if(variables('useExistingWorkspace'), createObject('value', variables('existingWorkspaceResourceId')), createObject('value', listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId))]",
-          "location": {
-            "value": "[coalesce(tryGet(parameters('applicationInsightsConfiguration'), 'location'), parameters('solutionLocation'))]"
-          },
-          "enableTelemetry": {
-            "value": "[parameters('enableTelemetry')]"
-          },
-          "tags": {
-            "value": "[coalesce(tryGet(parameters('applicationInsightsConfiguration'), 'tags'), parameters('tags'))]"
-          },
-          "retentionInDays": {
-            "value": "[coalesce(tryGet(parameters('applicationInsightsConfiguration'), 'retentionInDays'), 365)]"
-          },
-          "diagnosticSettings": {
-            "value": [
-              {
-                "workspaceResourceId": "[if(variables('useExistingWorkspace'), variables('existingWorkspaceResourceId'), listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId)]"
-              }
-            ]
-          },
-          "kind": {
-            "value": "web"
-          },
-          "disableIpMasking": {
-            "value": false
-          },
-          "flowType": {
-            "value": "Bluefield"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.33.93.31351",
-              "templateHash": "5735496719243704506"
-            },
-            "name": "Application Insights",
-            "description": "This component deploys an Application Insights instance."
-          },
-          "definitions": {
-            "diagnosticSettingFullType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the diagnostic setting."
-                  }
-                },
-                "logCategoriesAndGroups": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                        }
-                      },
-                      "categoryGroup": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                        }
-                      },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                  }
-                },
-                "metricCategories": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                        }
-                      },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                  }
-                },
-                "logAnalyticsDestinationType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "AzureDiagnostics",
-                    "Dedicated"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                  }
-                },
-                "workspaceResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "storageAccountResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "eventHubAuthorizationRuleResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                  }
-                },
-                "eventHubName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "marketplacePartnerResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.3.0"
-                }
-              }
-            },
-            "lockType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of lock."
-                  }
-                },
-                "kind": {
-                  "type": "string",
-                  "allowedValues": [
-                    "CanNotDelete",
-                    "None",
-                    "ReadOnly"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a lock.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "roleAssignmentType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                  }
-                },
-                "roleDefinitionIdOrName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                  }
-                },
-                "principalId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                  }
-                },
-                "principalType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Device",
-                    "ForeignGroup",
-                    "Group",
-                    "ServicePrincipal",
-                    "User"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The principal type of the assigned principal ID."
-                  }
-                },
-                "description": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The description of the role assignment."
-                  }
-                },
-                "condition": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                  }
-                },
-                "conditionVersion": {
-                  "type": "string",
-                  "allowedValues": [
-                    "2.0"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Version of the condition."
-                  }
-                },
-                "delegatedManagedIdentityResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a role assignment.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.3.0"
-                }
-              }
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. Name of the Application Insights."
-              }
-            },
-            "applicationType": {
-              "type": "string",
-              "defaultValue": "web",
-              "allowedValues": [
-                "web",
-                "other"
-              ],
-              "metadata": {
-                "description": "Optional. Application type."
-              }
-            },
-            "workspaceResourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. Resource ID of the log analytics workspace which the data will be ingested to. This property is required to create an application with this API version. Applications from older versions will not have this property."
-              }
-            },
-            "disableIpMasking": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Disable IP masking. Default value is set to true."
-              }
-            },
-            "disableLocalAuth": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Disable Non-AAD based Auth. Default value is set to false."
-              }
-            },
-            "forceCustomerStorageForProfiler": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Force users to create their own storage account for profiler and debugger."
-              }
-            },
-            "linkedStorageAccountResourceId": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Linked storage account resource ID."
-              }
-            },
-            "publicNetworkAccessForIngestion": {
-              "type": "string",
-              "defaultValue": "Enabled",
-              "allowedValues": [
-                "Enabled",
-                "Disabled"
-              ],
-              "metadata": {
-                "description": "Optional. The network access type for accessing Application Insights ingestion. - Enabled or Disabled."
-              }
-            },
-            "publicNetworkAccessForQuery": {
-              "type": "string",
-              "defaultValue": "Enabled",
-              "allowedValues": [
-                "Enabled",
-                "Disabled"
-              ],
-              "metadata": {
-                "description": "Optional. The network access type for accessing Application Insights query. - Enabled or Disabled."
-              }
-            },
-            "retentionInDays": {
-              "type": "int",
-              "defaultValue": 365,
-              "allowedValues": [
-                30,
-                60,
-                90,
-                120,
-                180,
-                270,
-                365,
-                550,
-                730
-              ],
-              "metadata": {
-                "description": "Optional. Retention period in days."
-              }
-            },
-            "samplingPercentage": {
-              "type": "int",
-              "defaultValue": 100,
-              "minValue": 0,
-              "maxValue": 100,
-              "metadata": {
-                "description": "Optional. Percentage of the data produced by the application being monitored that is being sampled for Application Insights telemetry."
-              }
-            },
-            "flowType": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Used by the Application Insights system to determine what kind of flow this component was created by. This is to be set to 'Bluefield' when creating/updating a component via the REST API."
-              }
-            },
-            "requestSource": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Describes what tool created this Application Insights component. Customers using this API should set this to the default 'rest'."
-              }
-            },
-            "kind": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. The kind of application that this component refers to, used to customize UI. This value is a freeform string, values should typically be one of the following: web, ios, other, store, java, phone."
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional. Location for all Resources."
-              }
-            },
-            "lock": {
-              "$ref": "#/definitions/lockType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The lock settings of the service."
-              }
-            },
-            "roleAssignments": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/roleAssignmentType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of role assignments to create."
-              }
-            },
-            "tags": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Tags of the resource."
-              }
-            },
-            "enableTelemetry": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Enable/Disable usage telemetry for module."
-              }
-            },
-            "diagnosticSettings": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/diagnosticSettingFullType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The diagnostic settings of the service."
-              }
-            }
-          },
-          "variables": {
-            "copy": [
-              {
-                "name": "formattedRoleAssignments",
-                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-              }
-            ],
-            "builtInRoleNames": {
-              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
-              "Monitoring Metrics Publisher": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3913510d-42f4-4e42-8a64-420c390055eb')]",
-              "Application Insights Component Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ae349356-3a1b-4a5e-921d-050484c6347e')]",
-              "Application Insights Snapshot Debugger": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '08954f03-6346-4c2e-81c0-ec3a5cfae23b')]",
-              "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]"
-            }
-          },
-          "resources": {
-            "avmTelemetry": {
-              "condition": "[parameters('enableTelemetry')]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.insights-component.{0}.{1}', replace('0.6.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-              "properties": {
-                "mode": "Incremental",
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "resources": [],
-                  "outputs": {
-                    "telemetry": {
-                      "type": "String",
-                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                    }
-                  }
-                }
-              }
-            },
-            "appInsights": {
-              "type": "Microsoft.Insights/components",
-              "apiVersion": "2020-02-02",
-              "name": "[parameters('name')]",
-              "location": "[parameters('location')]",
-              "tags": "[parameters('tags')]",
-              "kind": "[parameters('kind')]",
-              "properties": {
-                "Application_Type": "[parameters('applicationType')]",
-                "DisableIpMasking": "[parameters('disableIpMasking')]",
-                "DisableLocalAuth": "[parameters('disableLocalAuth')]",
-                "ForceCustomerStorageForProfiler": "[parameters('forceCustomerStorageForProfiler')]",
-                "WorkspaceResourceId": "[parameters('workspaceResourceId')]",
-                "publicNetworkAccessForIngestion": "[parameters('publicNetworkAccessForIngestion')]",
-                "publicNetworkAccessForQuery": "[parameters('publicNetworkAccessForQuery')]",
-                "RetentionInDays": "[parameters('retentionInDays')]",
-                "SamplingPercentage": "[parameters('samplingPercentage')]",
-                "Flow_Type": "[parameters('flowType')]",
-                "Request_Source": "[parameters('requestSource')]"
-              }
-            },
-            "appInsights_roleAssignments": {
-              "copy": {
-                "name": "appInsights_roleAssignments",
-                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-              },
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Insights/components', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-              "properties": {
-                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-              },
-              "dependsOn": [
-                "appInsights"
-              ]
-            },
-            "appInsights_lock": {
-              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-              "type": "Microsoft.Authorization/locks",
-              "apiVersion": "2020-05-01",
-              "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-              "properties": {
-                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-              },
-              "dependsOn": [
-                "appInsights"
-              ]
-            },
-            "appInsights_diagnosticSettings": {
-              "copy": {
-                "name": "appInsights_diagnosticSettings",
-                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-              },
-              "type": "Microsoft.Insights/diagnosticSettings",
-              "apiVersion": "2021-05-01-preview",
-              "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-              "properties": {
-                "copy": [
-                  {
-                    "name": "metrics",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                    "input": {
-                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                      "timeGrain": null
-                    }
-                  },
-                  {
-                    "name": "logs",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                    "input": {
-                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                    }
-                  }
-                ],
-                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-              },
-              "dependsOn": [
-                "appInsights"
-              ]
-            },
-            "linkedStorageAccount": {
-              "condition": "[not(empty(parameters('linkedStorageAccountResourceId')))]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-appInsights-linkedStorageAccount', uniqueString(deployment().name, parameters('location')))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "appInsightsName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "storageAccountResourceId": {
-                    "value": "[coalesce(parameters('linkedStorageAccountResourceId'), '')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.33.93.31351",
-                      "templateHash": "10861379689695100897"
-                    },
-                    "name": "Application Insights Linked Storage Account",
-                    "description": "This component deploys an Application Insights Linked Storage Account."
-                  },
-                  "parameters": {
-                    "appInsightsName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Application Insights instance. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "storageAccountResourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Linked storage account resource ID."
-                      }
-                    }
-                  },
-                  "resources": [
-                    {
-                      "type": "microsoft.insights/components/linkedStorageAccounts",
-                      "apiVersion": "2020-03-01-preview",
-                      "name": "[format('{0}/{1}', parameters('appInsightsName'), 'ServiceProfiler')]",
-                      "properties": {
-                        "linkedStorageAccount": "[parameters('storageAccountResourceId')]"
-                      }
-                    }
-                  ],
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the Linked Storage Account."
-                      },
-                      "value": "ServiceProfiler"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the Linked Storage Account."
-                      },
-                      "value": "[resourceId('microsoft.insights/components/linkedStorageAccounts', parameters('appInsightsName'), 'ServiceProfiler')]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group the agent pool was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "appInsights"
-              ]
-            }
-          },
-          "outputs": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the application insights component."
-              },
-              "value": "[parameters('name')]"
-            },
-            "resourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource ID of the application insights component."
-              },
-              "value": "[resourceId('Microsoft.Insights/components', parameters('name'))]"
-            },
-            "resourceGroupName": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource group the application insights component was deployed into."
-              },
-              "value": "[resourceGroup().name]"
-            },
-            "applicationId": {
-              "type": "string",
-              "metadata": {
-                "description": "The application ID of the application insights component."
-              },
-              "value": "[reference('appInsights').AppId]"
-            },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "The location the resource was deployed into."
-              },
-              "value": "[reference('appInsights', '2020-02-02', 'full').location]"
-            },
-            "instrumentationKey": {
-              "type": "string",
-              "metadata": {
-                "description": "Application Insights Instrumentation key. A read-only value that applications can use to identify the destination for all telemetry sent to Azure Application Insights. This value will be supplied upon construction of each new Application Insights component."
-              },
-              "value": "[reference('appInsights').InstrumentationKey]"
-            },
-            "connectionString": {
-              "type": "string",
-              "metadata": {
-                "description": "Application Insights Connection String."
-              },
-              "value": "[reference('appInsights').ConnectionString]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "logAnalyticsWorkspace"
-      ]
-    },
-    "userAssignedIdentity": {
-      "condition": "[variables('userAssignedManagedIdentityEnabled')]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2022-09-01",
-      "name": "[take(format('avm.res.managed-identity.user-assigned-identity.{0}', variables('userAssignedManagedIdentityResourceName')), 64)]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[variables('userAssignedManagedIdentityResourceName')]"
-          },
-          "tags": {
-            "value": "[coalesce(tryGet(parameters('userAssignedManagedIdentityConfiguration'), 'tags'), parameters('tags'))]"
-          },
-          "location": {
-            "value": "[coalesce(tryGet(parameters('userAssignedManagedIdentityConfiguration'), 'location'), parameters('solutionLocation'))]"
-          },
-          "enableTelemetry": {
-            "value": "[parameters('enableTelemetry')]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.34.44.8038",
-              "templateHash": "16707109626832623586"
-            },
-            "name": "User Assigned Identities",
-            "description": "This module deploys a User Assigned Identity."
-          },
-          "definitions": {
-            "federatedIdentityCredentialType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the federated identity credential."
-                  }
-                },
-                "audiences": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "metadata": {
-                    "description": "Required. The list of audiences that can appear in the issued token."
-                  }
-                },
-                "issuer": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The URL of the issuer to be trusted."
-                  }
-                },
-                "subject": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The identifier of the external identity."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for the federated identity credential."
-              }
-            },
-            "lockType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of lock."
-                  }
-                },
-                "kind": {
-                  "type": "string",
-                  "allowedValues": [
-                    "CanNotDelete",
-                    "None",
-                    "ReadOnly"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a lock.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "roleAssignmentType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                  }
-                },
-                "roleDefinitionIdOrName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                  }
-                },
-                "principalId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                  }
-                },
-                "principalType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Device",
-                    "ForeignGroup",
-                    "Group",
-                    "ServicePrincipal",
-                    "User"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The principal type of the assigned principal ID."
-                  }
-                },
-                "description": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The description of the role assignment."
-                  }
-                },
-                "condition": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                  }
-                },
-                "conditionVersion": {
-                  "type": "string",
-                  "allowedValues": [
-                    "2.0"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Version of the condition."
-                  }
-                },
-                "delegatedManagedIdentityResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a role assignment.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. Name of the User Assigned Identity."
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional. Location for all resources."
-              }
-            },
-            "federatedIdentityCredentials": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/federatedIdentityCredentialType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The federated identity credentials list to indicate which token from the external IdP should be trusted by your application. Federated identity credentials are supported on applications only. A maximum of 20 federated identity credentials can be added per application object."
-              }
-            },
-            "lock": {
-              "$ref": "#/definitions/lockType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The lock settings of the service."
-              }
-            },
-            "roleAssignments": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/roleAssignmentType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of role assignments to create."
-              }
-            },
-            "tags": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Tags of the resource."
-              }
-            },
-            "enableTelemetry": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Enable/Disable usage telemetry for module."
-              }
-            }
-          },
-          "variables": {
-            "copy": [
-              {
-                "name": "formattedRoleAssignments",
-                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-              }
-            ],
-            "builtInRoleNames": {
-              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-              "Managed Identity Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e40ec5ca-96e0-45a2-b4ff-59039f2c2b59')]",
-              "Managed Identity Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f1a07417-d97a-45cb-824c-7a7467783830')]",
-              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-            }
-          },
-          "resources": {
-            "avmTelemetry": {
-              "condition": "[parameters('enableTelemetry')]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.managedidentity-userassignedidentity.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-              "properties": {
-                "mode": "Incremental",
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "resources": [],
-                  "outputs": {
-                    "telemetry": {
-                      "type": "String",
-                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                    }
-                  }
-                }
-              }
-            },
-            "userAssignedIdentity": {
-              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
-              "apiVersion": "2024-11-30",
-              "name": "[parameters('name')]",
-              "location": "[parameters('location')]",
-              "tags": "[parameters('tags')]"
-            },
-            "userAssignedIdentity_lock": {
-              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-              "type": "Microsoft.Authorization/locks",
-              "apiVersion": "2020-05-01",
-              "scope": "[format('Microsoft.ManagedIdentity/userAssignedIdentities/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-              "properties": {
-                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-              },
-              "dependsOn": [
-                "userAssignedIdentity"
-              ]
-            },
-            "userAssignedIdentity_roleAssignments": {
-              "copy": {
-                "name": "userAssignedIdentity_roleAssignments",
-                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-              },
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[format('Microsoft.ManagedIdentity/userAssignedIdentities/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-              "properties": {
-                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-              },
-              "dependsOn": [
-                "userAssignedIdentity"
-              ]
-            },
-            "userAssignedIdentity_federatedIdentityCredentials": {
-              "copy": {
-                "name": "userAssignedIdentity_federatedIdentityCredentials",
-                "count": "[length(coalesce(parameters('federatedIdentityCredentials'), createArray()))]",
-                "mode": "serial",
-                "batchSize": 1
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-UserMSI-FederatedIdentityCred-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].name]"
-                  },
-                  "userAssignedIdentityName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "audiences": {
-                    "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].audiences]"
-                  },
-                  "issuer": {
-                    "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].issuer]"
-                  },
-                  "subject": {
-                    "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].subject]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "13656021764446440473"
-                    },
-                    "name": "User Assigned Identity Federated Identity Credential",
-                    "description": "This module deploys a User Assigned Identity Federated Identity Credential."
-                  },
-                  "parameters": {
-                    "userAssignedIdentityName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent user assigned identity. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the secret."
-                      }
-                    },
-                    "audiences": {
-                      "type": "array",
-                      "metadata": {
-                        "description": "Required. The list of audiences that can appear in the issued token. Should be set to api://AzureADTokenExchange for Azure AD. It says what Microsoft identity platform should accept in the aud claim in the incoming token. This value represents Azure AD in your external identity provider and has no fixed value across identity providers - you might need to create a new application registration in your IdP to serve as the audience of this token."
-                      }
-                    },
-                    "issuer": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The URL of the issuer to be trusted. Must match the issuer claim of the external token being exchanged."
-                      }
-                    },
-                    "subject": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The identifier of the external software workload within the external identity provider. Like the audience value, it has no fixed format, as each IdP uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. The value here must match the sub claim within the token presented to Azure AD."
-                      }
-                    }
-                  },
-                  "resources": [
-                    {
-                      "type": "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials",
-                      "apiVersion": "2024-11-30",
-                      "name": "[format('{0}/{1}', parameters('userAssignedIdentityName'), parameters('name'))]",
-                      "properties": {
-                        "audiences": "[parameters('audiences')]",
-                        "issuer": "[parameters('issuer')]",
-                        "subject": "[parameters('subject')]"
-                      }
-                    }
-                  ],
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the federated identity credential."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the federated identity credential."
-                      },
-                      "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials', parameters('userAssignedIdentityName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the resource group the federated identity credential was created in."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "userAssignedIdentity"
-              ]
-            }
-          },
-          "outputs": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the user assigned identity."
-              },
-              "value": "[parameters('name')]"
-            },
-            "resourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource ID of the user assigned identity."
-              },
-              "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name'))]"
-            },
-            "principalId": {
-              "type": "string",
-              "metadata": {
-                "description": "The principal ID (object ID) of the user assigned identity."
-              },
-              "value": "[reference('userAssignedIdentity').principalId]"
-            },
-            "clientId": {
-              "type": "string",
-              "metadata": {
-                "description": "The client ID (application ID) of the user assigned identity."
-              },
-              "value": "[reference('userAssignedIdentity').clientId]"
-            },
-            "resourceGroupName": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource group the user assigned identity was deployed into."
-              },
-              "value": "[resourceGroup().name]"
-            },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "The location the resource was deployed into."
-              },
-              "value": "[reference('userAssignedIdentity', '2024-11-30', 'full').location]"
-            }
-          }
-        }
-      }
-    },
-    "networkSecurityGroupBackend": {
-      "condition": "[and(variables('virtualNetworkEnabled'), variables('networkSecurityGroupBackendEnabled'))]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2022-09-01",
-      "name": "[take(format('avm.res.network.network-security-group.{0}', variables('networkSecurityGroupBackendResourceName')), 64)]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[variables('networkSecurityGroupBackendResourceName')]"
-          },
-          "location": {
-            "value": "[coalesce(tryGet(parameters('networkSecurityGroupBackendConfiguration'), 'location'), parameters('solutionLocation'))]"
-          },
-          "tags": {
-            "value": "[coalesce(tryGet(parameters('networkSecurityGroupBackendConfiguration'), 'tags'), parameters('tags'))]"
-          },
-          "enableTelemetry": {
-            "value": "[parameters('enableTelemetry')]"
-          },
-          "diagnosticSettings": {
-            "value": [
-              {
-                "workspaceResourceId": "[if(variables('useExistingWorkspace'), variables('existingWorkspaceResourceId'), listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId)]"
-              }
-            ]
-          },
-          "securityRules": {
-            "value": "[coalesce(tryGet(parameters('networkSecurityGroupBackendConfiguration'), 'securityRules'), createArray())]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.33.93.31351",
-              "templateHash": "2305747478751645177"
-            },
-            "name": "Network Security Groups",
-            "description": "This module deploys a Network security Group (NSG)."
-          },
-          "definitions": {
-            "securityRuleType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the security rule."
-                  }
-                },
-                "properties": {
-                  "type": "object",
-                  "properties": {
-                    "access": {
-                      "type": "string",
-                      "allowedValues": [
-                        "Allow",
-                        "Deny"
-                      ],
-                      "metadata": {
-                        "description": "Required. Whether network traffic is allowed or denied."
-                      }
-                    },
-                    "description": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The description of the security rule."
-                      }
-                    },
-                    "destinationAddressPrefix": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Optional. The destination address prefix. CIDR or destination IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used."
-                      }
-                    },
-                    "destinationAddressPrefixes": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The destination address prefixes. CIDR or destination IP ranges."
-                      }
-                    },
-                    "destinationApplicationSecurityGroupResourceIds": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The resource IDs of the application security groups specified as destination."
-                      }
-                    },
-                    "destinationPortRange": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The destination port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
-                      }
-                    },
-                    "destinationPortRanges": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The destination port ranges."
-                      }
-                    },
-                    "direction": {
-                      "type": "string",
-                      "allowedValues": [
-                        "Inbound",
-                        "Outbound"
-                      ],
-                      "metadata": {
-                        "description": "Required. The direction of the rule. The direction specifies if rule will be evaluated on incoming or outgoing traffic."
-                      }
-                    },
-                    "priority": {
-                      "type": "int",
-                      "minValue": 100,
-                      "maxValue": 4096,
-                      "metadata": {
-                        "description": "Required. Required. The priority of the rule. The value can be between 100 and 4096. The priority number must be unique for each rule in the collection. The lower the priority number, the higher the priority of the rule."
-                      }
-                    },
-                    "protocol": {
-                      "type": "string",
-                      "allowedValues": [
-                        "*",
-                        "Ah",
-                        "Esp",
-                        "Icmp",
-                        "Tcp",
-                        "Udp"
-                      ],
-                      "metadata": {
-                        "description": "Required. Network protocol this rule applies to."
-                      }
-                    },
-                    "sourceAddressPrefix": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The CIDR or source IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used. If this is an ingress rule, specifies where network traffic originates from."
-                      }
-                    },
-                    "sourceAddressPrefixes": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The CIDR or source IP ranges."
-                      }
-                    },
-                    "sourceApplicationSecurityGroupResourceIds": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The resource IDs of the application security groups specified as source."
-                      }
-                    },
-                    "sourcePortRange": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The source port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
-                      }
-                    },
-                    "sourcePortRanges": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The source port ranges."
-                      }
-                    }
-                  },
-                  "metadata": {
-                    "description": "Required. The properties of the security rule."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type of a security rule."
-              }
-            },
-            "diagnosticSettingLogsOnlyType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of diagnostic setting."
-                  }
-                },
-                "logCategoriesAndGroups": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                        }
-                      },
-                      "categoryGroup": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                        }
-                      },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                  }
-                },
-                "logAnalyticsDestinationType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "AzureDiagnostics",
-                    "Dedicated"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                  }
-                },
-                "workspaceResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "storageAccountResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "eventHubAuthorizationRuleResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                  }
-                },
-                "eventHubName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "marketplacePartnerResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a diagnostic setting. To be used if only logs are supported by the resource provider.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "lockType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of lock."
-                  }
-                },
-                "kind": {
-                  "type": "string",
-                  "allowedValues": [
-                    "CanNotDelete",
-                    "None",
-                    "ReadOnly"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a lock.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "roleAssignmentType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                  }
-                },
-                "roleDefinitionIdOrName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                  }
-                },
-                "principalId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                  }
-                },
-                "principalType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Device",
-                    "ForeignGroup",
-                    "Group",
-                    "ServicePrincipal",
-                    "User"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The principal type of the assigned principal ID."
-                  }
-                },
-                "description": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The description of the role assignment."
-                  }
-                },
-                "condition": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                  }
-                },
-                "conditionVersion": {
-                  "type": "string",
-                  "allowedValues": [
-                    "2.0"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Version of the condition."
-                  }
-                },
-                "delegatedManagedIdentityResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a role assignment.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. Name of the Network Security Group."
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional. Location for all resources."
-              }
-            },
-            "securityRules": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/securityRuleType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of Security Rules to deploy to the Network Security Group. When not provided, an NSG including only the built-in roles will be deployed."
-              }
-            },
-            "flushConnection": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. When enabled, flows created from Network Security Group connections will be re-evaluated when rules are updates. Initial enablement will trigger re-evaluation. Network Security Group connection flushing is not available in all regions."
-              }
-            },
-            "diagnosticSettings": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/diagnosticSettingLogsOnlyType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The diagnostic settings of the service."
-              }
-            },
-            "lock": {
-              "$ref": "#/definitions/lockType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The lock settings of the service."
-              }
-            },
-            "roleAssignments": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/roleAssignmentType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of role assignments to create."
-              }
-            },
-            "tags": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Tags of the NSG resource."
-              }
-            },
-            "enableTelemetry": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Enable/Disable usage telemetry for module."
-              }
-            }
-          },
-          "variables": {
-            "copy": [
-              {
-                "name": "formattedRoleAssignments",
-                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-              }
-            ],
-            "builtInRoleNames": {
-              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-            }
-          },
-          "resources": {
-            "avmTelemetry": {
-              "condition": "[parameters('enableTelemetry')]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-networksecuritygroup.{0}.{1}', replace('0.5.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-              "properties": {
-                "mode": "Incremental",
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "resources": [],
-                  "outputs": {
-                    "telemetry": {
-                      "type": "String",
-                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                    }
-                  }
-                }
-              }
-            },
-            "networkSecurityGroup": {
-              "type": "Microsoft.Network/networkSecurityGroups",
-              "apiVersion": "2023-11-01",
-              "name": "[parameters('name')]",
-              "location": "[parameters('location')]",
-              "tags": "[parameters('tags')]",
-              "properties": {
-                "copy": [
-                  {
-                    "name": "securityRules",
-                    "count": "[length(coalesce(parameters('securityRules'), createArray()))]",
-                    "input": {
-                      "name": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].name]",
-                      "properties": {
-                        "access": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.access]",
-                        "description": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'description'), '')]",
-                        "destinationAddressPrefix": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationAddressPrefix'), '')]",
-                        "destinationAddressPrefixes": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationAddressPrefixes'), createArray())]",
-                        "destinationApplicationSecurityGroups": "[map(coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationApplicationSecurityGroupResourceIds'), createArray()), lambda('destinationApplicationSecurityGroupResourceId', createObject('id', lambdaVariables('destinationApplicationSecurityGroupResourceId'))))]",
-                        "destinationPortRange": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationPortRange'), '')]",
-                        "destinationPortRanges": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationPortRanges'), createArray())]",
-                        "direction": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.direction]",
-                        "priority": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.priority]",
-                        "protocol": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.protocol]",
-                        "sourceAddressPrefix": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceAddressPrefix'), '')]",
-                        "sourceAddressPrefixes": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceAddressPrefixes'), createArray())]",
-                        "sourceApplicationSecurityGroups": "[map(coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceApplicationSecurityGroupResourceIds'), createArray()), lambda('sourceApplicationSecurityGroupResourceId', createObject('id', lambdaVariables('sourceApplicationSecurityGroupResourceId'))))]",
-                        "sourcePortRange": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourcePortRange'), '')]",
-                        "sourcePortRanges": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourcePortRanges'), createArray())]"
-                      }
-                    }
-                  }
-                ],
-                "flushConnection": "[parameters('flushConnection')]"
-              }
-            },
-            "networkSecurityGroup_lock": {
-              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-              "type": "Microsoft.Authorization/locks",
-              "apiVersion": "2020-05-01",
-              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-              "properties": {
-                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-              },
-              "dependsOn": [
-                "networkSecurityGroup"
-              ]
-            },
-            "networkSecurityGroup_diagnosticSettings": {
-              "copy": {
-                "name": "networkSecurityGroup_diagnosticSettings",
-                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-              },
-              "type": "Microsoft.Insights/diagnosticSettings",
-              "apiVersion": "2021-05-01-preview",
-              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-              "properties": {
-                "copy": [
-                  {
-                    "name": "logs",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                    "input": {
-                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                    }
-                  }
-                ],
-                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-              },
-              "dependsOn": [
-                "networkSecurityGroup"
-              ]
-            },
-            "networkSecurityGroup_roleAssignments": {
-              "copy": {
-                "name": "networkSecurityGroup_roleAssignments",
-                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-              },
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/networkSecurityGroups', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-              "properties": {
-                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-              },
-              "dependsOn": [
-                "networkSecurityGroup"
-              ]
-            }
-          },
-          "outputs": {
-            "resourceGroupName": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource group the network security group was deployed into."
-              },
-              "value": "[resourceGroup().name]"
-            },
-            "resourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource ID of the network security group."
-              },
-              "value": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]"
-            },
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the network security group."
-              },
-              "value": "[parameters('name')]"
-            },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "The location the resource was deployed into."
-              },
-              "value": "[reference('networkSecurityGroup', '2023-11-01', 'full').location]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "logAnalyticsWorkspace"
-      ]
-    },
-    "networkSecurityGroupContainers": {
-      "condition": "[and(variables('virtualNetworkEnabled'), variables('networkSecurityGroupContainersEnabled'))]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2022-09-01",
-      "name": "[take(format('avm.res.network.network-security-group.{0}', variables('networkSecurityGroupContainersResourceName')), 64)]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[variables('networkSecurityGroupContainersResourceName')]"
-          },
-          "location": {
-            "value": "[coalesce(tryGet(parameters('networkSecurityGroupContainersConfiguration'), 'location'), parameters('solutionLocation'))]"
-          },
-          "tags": {
-            "value": "[coalesce(tryGet(parameters('networkSecurityGroupContainersConfiguration'), 'tags'), parameters('tags'))]"
-          },
-          "enableTelemetry": {
-            "value": "[parameters('enableTelemetry')]"
-          },
-          "diagnosticSettings": {
-            "value": [
-              {
-                "workspaceResourceId": "[if(variables('useExistingWorkspace'), variables('existingWorkspaceResourceId'), listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId)]"
-              }
-            ]
-          },
-          "securityRules": {
-            "value": "[coalesce(tryGet(parameters('networkSecurityGroupContainersConfiguration'), 'securityRules'), createArray())]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.33.93.31351",
-              "templateHash": "2305747478751645177"
-            },
-            "name": "Network Security Groups",
-            "description": "This module deploys a Network security Group (NSG)."
-          },
-          "definitions": {
-            "securityRuleType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the security rule."
-                  }
-                },
-                "properties": {
-                  "type": "object",
-                  "properties": {
-                    "access": {
-                      "type": "string",
-                      "allowedValues": [
-                        "Allow",
-                        "Deny"
-                      ],
-                      "metadata": {
-                        "description": "Required. Whether network traffic is allowed or denied."
-                      }
-                    },
-                    "description": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The description of the security rule."
-                      }
-                    },
-                    "destinationAddressPrefix": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Optional. The destination address prefix. CIDR or destination IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used."
-                      }
-                    },
-                    "destinationAddressPrefixes": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The destination address prefixes. CIDR or destination IP ranges."
-                      }
-                    },
-                    "destinationApplicationSecurityGroupResourceIds": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The resource IDs of the application security groups specified as destination."
-                      }
-                    },
-                    "destinationPortRange": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The destination port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
-                      }
-                    },
-                    "destinationPortRanges": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The destination port ranges."
-                      }
-                    },
-                    "direction": {
-                      "type": "string",
-                      "allowedValues": [
-                        "Inbound",
-                        "Outbound"
-                      ],
-                      "metadata": {
-                        "description": "Required. The direction of the rule. The direction specifies if rule will be evaluated on incoming or outgoing traffic."
-                      }
-                    },
-                    "priority": {
-                      "type": "int",
-                      "minValue": 100,
-                      "maxValue": 4096,
-                      "metadata": {
-                        "description": "Required. Required. The priority of the rule. The value can be between 100 and 4096. The priority number must be unique for each rule in the collection. The lower the priority number, the higher the priority of the rule."
-                      }
-                    },
-                    "protocol": {
-                      "type": "string",
-                      "allowedValues": [
-                        "*",
-                        "Ah",
-                        "Esp",
-                        "Icmp",
-                        "Tcp",
-                        "Udp"
-                      ],
-                      "metadata": {
-                        "description": "Required. Network protocol this rule applies to."
-                      }
-                    },
-                    "sourceAddressPrefix": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The CIDR or source IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used. If this is an ingress rule, specifies where network traffic originates from."
-                      }
-                    },
-                    "sourceAddressPrefixes": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The CIDR or source IP ranges."
-                      }
-                    },
-                    "sourceApplicationSecurityGroupResourceIds": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The resource IDs of the application security groups specified as source."
-                      }
-                    },
-                    "sourcePortRange": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The source port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
-                      }
-                    },
-                    "sourcePortRanges": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The source port ranges."
-                      }
-                    }
-                  },
-                  "metadata": {
-                    "description": "Required. The properties of the security rule."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type of a security rule."
-              }
-            },
-            "diagnosticSettingLogsOnlyType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of diagnostic setting."
-                  }
-                },
-                "logCategoriesAndGroups": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                        }
-                      },
-                      "categoryGroup": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                        }
-                      },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                  }
-                },
-                "logAnalyticsDestinationType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "AzureDiagnostics",
-                    "Dedicated"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                  }
-                },
-                "workspaceResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "storageAccountResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "eventHubAuthorizationRuleResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                  }
-                },
-                "eventHubName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "marketplacePartnerResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a diagnostic setting. To be used if only logs are supported by the resource provider.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "lockType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of lock."
-                  }
-                },
-                "kind": {
-                  "type": "string",
-                  "allowedValues": [
-                    "CanNotDelete",
-                    "None",
-                    "ReadOnly"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a lock.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "roleAssignmentType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                  }
-                },
-                "roleDefinitionIdOrName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                  }
-                },
-                "principalId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                  }
-                },
-                "principalType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Device",
-                    "ForeignGroup",
-                    "Group",
-                    "ServicePrincipal",
-                    "User"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The principal type of the assigned principal ID."
-                  }
-                },
-                "description": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The description of the role assignment."
-                  }
-                },
-                "condition": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                  }
-                },
-                "conditionVersion": {
-                  "type": "string",
-                  "allowedValues": [
-                    "2.0"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Version of the condition."
-                  }
-                },
-                "delegatedManagedIdentityResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a role assignment.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. Name of the Network Security Group."
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional. Location for all resources."
-              }
-            },
-            "securityRules": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/securityRuleType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of Security Rules to deploy to the Network Security Group. When not provided, an NSG including only the built-in roles will be deployed."
-              }
-            },
-            "flushConnection": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. When enabled, flows created from Network Security Group connections will be re-evaluated when rules are updates. Initial enablement will trigger re-evaluation. Network Security Group connection flushing is not available in all regions."
-              }
-            },
-            "diagnosticSettings": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/diagnosticSettingLogsOnlyType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The diagnostic settings of the service."
-              }
-            },
-            "lock": {
-              "$ref": "#/definitions/lockType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The lock settings of the service."
-              }
-            },
-            "roleAssignments": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/roleAssignmentType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of role assignments to create."
-              }
-            },
-            "tags": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Tags of the NSG resource."
-              }
-            },
-            "enableTelemetry": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Enable/Disable usage telemetry for module."
-              }
-            }
-          },
-          "variables": {
-            "copy": [
-              {
-                "name": "formattedRoleAssignments",
-                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-              }
-            ],
-            "builtInRoleNames": {
-              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-            }
-          },
-          "resources": {
-            "avmTelemetry": {
-              "condition": "[parameters('enableTelemetry')]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-networksecuritygroup.{0}.{1}', replace('0.5.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-              "properties": {
-                "mode": "Incremental",
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "resources": [],
-                  "outputs": {
-                    "telemetry": {
-                      "type": "String",
-                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                    }
-                  }
-                }
-              }
-            },
-            "networkSecurityGroup": {
-              "type": "Microsoft.Network/networkSecurityGroups",
-              "apiVersion": "2023-11-01",
-              "name": "[parameters('name')]",
-              "location": "[parameters('location')]",
-              "tags": "[parameters('tags')]",
-              "properties": {
-                "copy": [
-                  {
-                    "name": "securityRules",
-                    "count": "[length(coalesce(parameters('securityRules'), createArray()))]",
-                    "input": {
-                      "name": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].name]",
-                      "properties": {
-                        "access": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.access]",
-                        "description": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'description'), '')]",
-                        "destinationAddressPrefix": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationAddressPrefix'), '')]",
-                        "destinationAddressPrefixes": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationAddressPrefixes'), createArray())]",
-                        "destinationApplicationSecurityGroups": "[map(coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationApplicationSecurityGroupResourceIds'), createArray()), lambda('destinationApplicationSecurityGroupResourceId', createObject('id', lambdaVariables('destinationApplicationSecurityGroupResourceId'))))]",
-                        "destinationPortRange": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationPortRange'), '')]",
-                        "destinationPortRanges": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationPortRanges'), createArray())]",
-                        "direction": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.direction]",
-                        "priority": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.priority]",
-                        "protocol": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.protocol]",
-                        "sourceAddressPrefix": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceAddressPrefix'), '')]",
-                        "sourceAddressPrefixes": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceAddressPrefixes'), createArray())]",
-                        "sourceApplicationSecurityGroups": "[map(coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceApplicationSecurityGroupResourceIds'), createArray()), lambda('sourceApplicationSecurityGroupResourceId', createObject('id', lambdaVariables('sourceApplicationSecurityGroupResourceId'))))]",
-                        "sourcePortRange": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourcePortRange'), '')]",
-                        "sourcePortRanges": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourcePortRanges'), createArray())]"
-                      }
-                    }
-                  }
-                ],
-                "flushConnection": "[parameters('flushConnection')]"
-              }
-            },
-            "networkSecurityGroup_lock": {
-              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-              "type": "Microsoft.Authorization/locks",
-              "apiVersion": "2020-05-01",
-              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-              "properties": {
-                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-              },
-              "dependsOn": [
-                "networkSecurityGroup"
-              ]
-            },
-            "networkSecurityGroup_diagnosticSettings": {
-              "copy": {
-                "name": "networkSecurityGroup_diagnosticSettings",
-                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-              },
-              "type": "Microsoft.Insights/diagnosticSettings",
-              "apiVersion": "2021-05-01-preview",
-              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-              "properties": {
-                "copy": [
-                  {
-                    "name": "logs",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                    "input": {
-                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                    }
-                  }
-                ],
-                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-              },
-              "dependsOn": [
-                "networkSecurityGroup"
-              ]
-            },
-            "networkSecurityGroup_roleAssignments": {
-              "copy": {
-                "name": "networkSecurityGroup_roleAssignments",
-                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-              },
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/networkSecurityGroups', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-              "properties": {
-                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-              },
-              "dependsOn": [
-                "networkSecurityGroup"
-              ]
-            }
-          },
-          "outputs": {
-            "resourceGroupName": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource group the network security group was deployed into."
-              },
-              "value": "[resourceGroup().name]"
-            },
-            "resourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource ID of the network security group."
-              },
-              "value": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]"
-            },
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the network security group."
-              },
-              "value": "[parameters('name')]"
-            },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "The location the resource was deployed into."
-              },
-              "value": "[reference('networkSecurityGroup', '2023-11-01', 'full').location]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "logAnalyticsWorkspace"
-      ]
-    },
-    "networkSecurityGroupBastion": {
-      "condition": "[and(variables('virtualNetworkEnabled'), variables('networkSecurityGroupBastionEnabled'))]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2022-09-01",
-      "name": "[take(format('avm.res.network.network-security-group.{0}', variables('networkSecurityGroupBastionResourceName')), 64)]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[variables('networkSecurityGroupBastionResourceName')]"
-          },
-          "location": {
-            "value": "[coalesce(tryGet(parameters('networkSecurityGroupBastionConfiguration'), 'location'), parameters('solutionLocation'))]"
-          },
-          "tags": {
-            "value": "[coalesce(tryGet(parameters('networkSecurityGroupBastionConfiguration'), 'tags'), parameters('tags'))]"
-          },
-          "enableTelemetry": {
-            "value": "[parameters('enableTelemetry')]"
-          },
-          "diagnosticSettings": {
-            "value": [
-              {
-                "workspaceResourceId": "[if(variables('useExistingWorkspace'), variables('existingWorkspaceResourceId'), listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId)]"
-              }
-            ]
-          },
-          "securityRules": {
-            "value": "[coalesce(tryGet(parameters('networkSecurityGroupBastionConfiguration'), 'securityRules'), createArray(createObject('name', 'AllowHttpsInBound', 'properties', createObject('protocol', 'Tcp', 'sourcePortRange', '*', 'sourceAddressPrefix', 'Internet', 'destinationPortRange', '443', 'destinationAddressPrefix', '*', 'access', 'Allow', 'priority', 100, 'direction', 'Inbound')), createObject('name', 'AllowGatewayManagerInBound', 'properties', createObject('protocol', 'Tcp', 'sourcePortRange', '*', 'sourceAddressPrefix', 'GatewayManager', 'destinationPortRange', '443', 'destinationAddressPrefix', '*', 'access', 'Allow', 'priority', 110, 'direction', 'Inbound')), createObject('name', 'AllowLoadBalancerInBound', 'properties', createObject('protocol', 'Tcp', 'sourcePortRange', '*', 'sourceAddressPrefix', 'AzureLoadBalancer', 'destinationPortRange', '443', 'destinationAddressPrefix', '*', 'access', 'Allow', 'priority', 120, 'direction', 'Inbound')), createObject('name', 'AllowBastionHostCommunicationInBound', 'properties', createObject('protocol', '*', 'sourcePortRange', '*', 'sourceAddressPrefix', 'VirtualNetwork', 'destinationPortRanges', createArray('8080', '5701'), 'destinationAddressPrefix', 'VirtualNetwork', 'access', 'Allow', 'priority', 130, 'direction', 'Inbound')), createObject('name', 'DenyAllInBound', 'properties', createObject('protocol', '*', 'sourcePortRange', '*', 'sourceAddressPrefix', '*', 'destinationPortRange', '*', 'destinationAddressPrefix', '*', 'access', 'Deny', 'priority', 1000, 'direction', 'Inbound')), createObject('name', 'AllowSshRdpOutBound', 'properties', createObject('protocol', 'Tcp', 'sourcePortRange', '*', 'sourceAddressPrefix', '*', 'destinationPortRanges', createArray('22', '3389'), 'destinationAddressPrefix', 'VirtualNetwork', 'access', 'Allow', 'priority', 100, 'direction', 'Outbound')), createObject('name', 'AllowAzureCloudCommunicationOutBound', 'properties', createObject('protocol', 'Tcp', 'sourcePortRange', '*', 'sourceAddressPrefix', '*', 'destinationPortRange', '443', 'destinationAddressPrefix', 'AzureCloud', 'access', 'Allow', 'priority', 110, 'direction', 'Outbound')), createObject('name', 'AllowBastionHostCommunicationOutBound', 'properties', createObject('protocol', '*', 'sourcePortRange', '*', 'sourceAddressPrefix', 'VirtualNetwork', 'destinationPortRanges', createArray('8080', '5701'), 'destinationAddressPrefix', 'VirtualNetwork', 'access', 'Allow', 'priority', 120, 'direction', 'Outbound')), createObject('name', 'AllowGetSessionInformationOutBound', 'properties', createObject('protocol', '*', 'sourcePortRange', '*', 'sourceAddressPrefix', '*', 'destinationAddressPrefix', 'Internet', 'destinationPortRanges', createArray('80', '443'), 'access', 'Allow', 'priority', 130, 'direction', 'Outbound')), createObject('name', 'DenyAllOutBound', 'properties', createObject('protocol', '*', 'sourcePortRange', '*', 'destinationPortRange', '*', 'sourceAddressPrefix', '*', 'destinationAddressPrefix', '*', 'access', 'Deny', 'priority', 1000, 'direction', 'Outbound'))))]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.33.93.31351",
-              "templateHash": "2305747478751645177"
-            },
-            "name": "Network Security Groups",
-            "description": "This module deploys a Network security Group (NSG)."
-          },
-          "definitions": {
-            "securityRuleType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the security rule."
-                  }
-                },
-                "properties": {
-                  "type": "object",
-                  "properties": {
-                    "access": {
-                      "type": "string",
-                      "allowedValues": [
-                        "Allow",
-                        "Deny"
-                      ],
-                      "metadata": {
-                        "description": "Required. Whether network traffic is allowed or denied."
-                      }
-                    },
-                    "description": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The description of the security rule."
-                      }
-                    },
-                    "destinationAddressPrefix": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Optional. The destination address prefix. CIDR or destination IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used."
-                      }
-                    },
-                    "destinationAddressPrefixes": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The destination address prefixes. CIDR or destination IP ranges."
-                      }
-                    },
-                    "destinationApplicationSecurityGroupResourceIds": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The resource IDs of the application security groups specified as destination."
-                      }
-                    },
-                    "destinationPortRange": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The destination port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
-                      }
-                    },
-                    "destinationPortRanges": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The destination port ranges."
-                      }
-                    },
-                    "direction": {
-                      "type": "string",
-                      "allowedValues": [
-                        "Inbound",
-                        "Outbound"
-                      ],
-                      "metadata": {
-                        "description": "Required. The direction of the rule. The direction specifies if rule will be evaluated on incoming or outgoing traffic."
-                      }
-                    },
-                    "priority": {
-                      "type": "int",
-                      "minValue": 100,
-                      "maxValue": 4096,
-                      "metadata": {
-                        "description": "Required. Required. The priority of the rule. The value can be between 100 and 4096. The priority number must be unique for each rule in the collection. The lower the priority number, the higher the priority of the rule."
-                      }
-                    },
-                    "protocol": {
-                      "type": "string",
-                      "allowedValues": [
-                        "*",
-                        "Ah",
-                        "Esp",
-                        "Icmp",
-                        "Tcp",
-                        "Udp"
-                      ],
-                      "metadata": {
-                        "description": "Required. Network protocol this rule applies to."
-                      }
-                    },
-                    "sourceAddressPrefix": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The CIDR or source IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used. If this is an ingress rule, specifies where network traffic originates from."
-                      }
-                    },
-                    "sourceAddressPrefixes": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The CIDR or source IP ranges."
-                      }
-                    },
-                    "sourceApplicationSecurityGroupResourceIds": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The resource IDs of the application security groups specified as source."
-                      }
-                    },
-                    "sourcePortRange": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The source port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
-                      }
-                    },
-                    "sourcePortRanges": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The source port ranges."
-                      }
-                    }
-                  },
-                  "metadata": {
-                    "description": "Required. The properties of the security rule."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type of a security rule."
-              }
-            },
-            "diagnosticSettingLogsOnlyType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of diagnostic setting."
-                  }
-                },
-                "logCategoriesAndGroups": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                        }
-                      },
-                      "categoryGroup": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                        }
-                      },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                  }
-                },
-                "logAnalyticsDestinationType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "AzureDiagnostics",
-                    "Dedicated"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                  }
-                },
-                "workspaceResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "storageAccountResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "eventHubAuthorizationRuleResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                  }
-                },
-                "eventHubName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "marketplacePartnerResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a diagnostic setting. To be used if only logs are supported by the resource provider.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "lockType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of lock."
-                  }
-                },
-                "kind": {
-                  "type": "string",
-                  "allowedValues": [
-                    "CanNotDelete",
-                    "None",
-                    "ReadOnly"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a lock.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "roleAssignmentType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                  }
-                },
-                "roleDefinitionIdOrName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                  }
-                },
-                "principalId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                  }
-                },
-                "principalType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Device",
-                    "ForeignGroup",
-                    "Group",
-                    "ServicePrincipal",
-                    "User"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The principal type of the assigned principal ID."
-                  }
-                },
-                "description": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The description of the role assignment."
-                  }
-                },
-                "condition": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                  }
-                },
-                "conditionVersion": {
-                  "type": "string",
-                  "allowedValues": [
-                    "2.0"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Version of the condition."
-                  }
-                },
-                "delegatedManagedIdentityResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a role assignment.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. Name of the Network Security Group."
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional. Location for all resources."
-              }
-            },
-            "securityRules": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/securityRuleType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of Security Rules to deploy to the Network Security Group. When not provided, an NSG including only the built-in roles will be deployed."
-              }
-            },
-            "flushConnection": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. When enabled, flows created from Network Security Group connections will be re-evaluated when rules are updates. Initial enablement will trigger re-evaluation. Network Security Group connection flushing is not available in all regions."
-              }
-            },
-            "diagnosticSettings": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/diagnosticSettingLogsOnlyType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The diagnostic settings of the service."
-              }
-            },
-            "lock": {
-              "$ref": "#/definitions/lockType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The lock settings of the service."
-              }
-            },
-            "roleAssignments": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/roleAssignmentType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of role assignments to create."
-              }
-            },
-            "tags": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Tags of the NSG resource."
-              }
-            },
-            "enableTelemetry": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Enable/Disable usage telemetry for module."
-              }
-            }
-          },
-          "variables": {
-            "copy": [
-              {
-                "name": "formattedRoleAssignments",
-                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-              }
-            ],
-            "builtInRoleNames": {
-              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-            }
-          },
-          "resources": {
-            "avmTelemetry": {
-              "condition": "[parameters('enableTelemetry')]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-networksecuritygroup.{0}.{1}', replace('0.5.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-              "properties": {
-                "mode": "Incremental",
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "resources": [],
-                  "outputs": {
-                    "telemetry": {
-                      "type": "String",
-                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                    }
-                  }
-                }
-              }
-            },
-            "networkSecurityGroup": {
-              "type": "Microsoft.Network/networkSecurityGroups",
-              "apiVersion": "2023-11-01",
-              "name": "[parameters('name')]",
-              "location": "[parameters('location')]",
-              "tags": "[parameters('tags')]",
-              "properties": {
-                "copy": [
-                  {
-                    "name": "securityRules",
-                    "count": "[length(coalesce(parameters('securityRules'), createArray()))]",
-                    "input": {
-                      "name": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].name]",
-                      "properties": {
-                        "access": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.access]",
-                        "description": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'description'), '')]",
-                        "destinationAddressPrefix": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationAddressPrefix'), '')]",
-                        "destinationAddressPrefixes": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationAddressPrefixes'), createArray())]",
-                        "destinationApplicationSecurityGroups": "[map(coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationApplicationSecurityGroupResourceIds'), createArray()), lambda('destinationApplicationSecurityGroupResourceId', createObject('id', lambdaVariables('destinationApplicationSecurityGroupResourceId'))))]",
-                        "destinationPortRange": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationPortRange'), '')]",
-                        "destinationPortRanges": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationPortRanges'), createArray())]",
-                        "direction": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.direction]",
-                        "priority": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.priority]",
-                        "protocol": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.protocol]",
-                        "sourceAddressPrefix": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceAddressPrefix'), '')]",
-                        "sourceAddressPrefixes": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceAddressPrefixes'), createArray())]",
-                        "sourceApplicationSecurityGroups": "[map(coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceApplicationSecurityGroupResourceIds'), createArray()), lambda('sourceApplicationSecurityGroupResourceId', createObject('id', lambdaVariables('sourceApplicationSecurityGroupResourceId'))))]",
-                        "sourcePortRange": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourcePortRange'), '')]",
-                        "sourcePortRanges": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourcePortRanges'), createArray())]"
-                      }
-                    }
-                  }
-                ],
-                "flushConnection": "[parameters('flushConnection')]"
-              }
-            },
-            "networkSecurityGroup_lock": {
-              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-              "type": "Microsoft.Authorization/locks",
-              "apiVersion": "2020-05-01",
-              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-              "properties": {
-                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-              },
-              "dependsOn": [
-                "networkSecurityGroup"
-              ]
-            },
-            "networkSecurityGroup_diagnosticSettings": {
-              "copy": {
-                "name": "networkSecurityGroup_diagnosticSettings",
-                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-              },
-              "type": "Microsoft.Insights/diagnosticSettings",
-              "apiVersion": "2021-05-01-preview",
-              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-              "properties": {
-                "copy": [
-                  {
-                    "name": "logs",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                    "input": {
-                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                    }
-                  }
-                ],
-                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-              },
-              "dependsOn": [
-                "networkSecurityGroup"
-              ]
-            },
-            "networkSecurityGroup_roleAssignments": {
-              "copy": {
-                "name": "networkSecurityGroup_roleAssignments",
-                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-              },
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/networkSecurityGroups', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-              "properties": {
-                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-              },
-              "dependsOn": [
-                "networkSecurityGroup"
-              ]
-            }
-          },
-          "outputs": {
-            "resourceGroupName": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource group the network security group was deployed into."
-              },
-              "value": "[resourceGroup().name]"
-            },
-            "resourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource ID of the network security group."
-              },
-              "value": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]"
-            },
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the network security group."
-              },
-              "value": "[parameters('name')]"
-            },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "The location the resource was deployed into."
-              },
-              "value": "[reference('networkSecurityGroup', '2023-11-01', 'full').location]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "logAnalyticsWorkspace"
-      ]
-    },
-    "networkSecurityGroupAdministration": {
-      "condition": "[and(variables('virtualNetworkEnabled'), variables('networkSecurityGroupAdministrationEnabled'))]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2022-09-01",
-      "name": "[take(format('avm.res.network.network-security-group.{0}', variables('networkSecurityGroupAdministrationResourceName')), 64)]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[variables('networkSecurityGroupAdministrationResourceName')]"
-          },
-          "location": {
-            "value": "[coalesce(tryGet(parameters('networkSecurityGroupAdministrationConfiguration'), 'location'), parameters('solutionLocation'))]"
-          },
-          "tags": {
-            "value": "[coalesce(tryGet(parameters('networkSecurityGroupAdministrationConfiguration'), 'tags'), parameters('tags'))]"
-          },
-          "enableTelemetry": {
-            "value": "[parameters('enableTelemetry')]"
-          },
-          "diagnosticSettings": {
-            "value": [
-              {
-                "workspaceResourceId": "[if(variables('useExistingWorkspace'), variables('existingWorkspaceResourceId'), listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId)]"
-              }
-            ]
-          },
-          "securityRules": {
-            "value": "[coalesce(tryGet(parameters('networkSecurityGroupAdministrationConfiguration'), 'securityRules'), createArray())]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.33.93.31351",
-              "templateHash": "2305747478751645177"
-            },
-            "name": "Network Security Groups",
-            "description": "This module deploys a Network security Group (NSG)."
-          },
-          "definitions": {
-            "securityRuleType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the security rule."
-                  }
-                },
-                "properties": {
-                  "type": "object",
-                  "properties": {
-                    "access": {
-                      "type": "string",
-                      "allowedValues": [
-                        "Allow",
-                        "Deny"
-                      ],
-                      "metadata": {
-                        "description": "Required. Whether network traffic is allowed or denied."
-                      }
-                    },
-                    "description": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The description of the security rule."
-                      }
-                    },
-                    "destinationAddressPrefix": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Optional. The destination address prefix. CIDR or destination IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used."
-                      }
-                    },
-                    "destinationAddressPrefixes": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The destination address prefixes. CIDR or destination IP ranges."
-                      }
-                    },
-                    "destinationApplicationSecurityGroupResourceIds": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The resource IDs of the application security groups specified as destination."
-                      }
-                    },
-                    "destinationPortRange": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The destination port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
-                      }
-                    },
-                    "destinationPortRanges": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The destination port ranges."
-                      }
-                    },
-                    "direction": {
-                      "type": "string",
-                      "allowedValues": [
-                        "Inbound",
-                        "Outbound"
-                      ],
-                      "metadata": {
-                        "description": "Required. The direction of the rule. The direction specifies if rule will be evaluated on incoming or outgoing traffic."
-                      }
-                    },
-                    "priority": {
-                      "type": "int",
-                      "minValue": 100,
-                      "maxValue": 4096,
-                      "metadata": {
-                        "description": "Required. Required. The priority of the rule. The value can be between 100 and 4096. The priority number must be unique for each rule in the collection. The lower the priority number, the higher the priority of the rule."
-                      }
-                    },
-                    "protocol": {
-                      "type": "string",
-                      "allowedValues": [
-                        "*",
-                        "Ah",
-                        "Esp",
-                        "Icmp",
-                        "Tcp",
-                        "Udp"
-                      ],
-                      "metadata": {
-                        "description": "Required. Network protocol this rule applies to."
-                      }
-                    },
-                    "sourceAddressPrefix": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The CIDR or source IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used. If this is an ingress rule, specifies where network traffic originates from."
-                      }
-                    },
-                    "sourceAddressPrefixes": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The CIDR or source IP ranges."
-                      }
-                    },
-                    "sourceApplicationSecurityGroupResourceIds": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The resource IDs of the application security groups specified as source."
-                      }
-                    },
-                    "sourcePortRange": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The source port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
-                      }
-                    },
-                    "sourcePortRanges": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The source port ranges."
-                      }
-                    }
-                  },
-                  "metadata": {
-                    "description": "Required. The properties of the security rule."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type of a security rule."
-              }
-            },
-            "diagnosticSettingLogsOnlyType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of diagnostic setting."
-                  }
-                },
-                "logCategoriesAndGroups": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                        }
-                      },
-                      "categoryGroup": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                        }
-                      },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                  }
-                },
-                "logAnalyticsDestinationType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "AzureDiagnostics",
-                    "Dedicated"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                  }
-                },
-                "workspaceResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "storageAccountResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "eventHubAuthorizationRuleResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                  }
-                },
-                "eventHubName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "marketplacePartnerResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a diagnostic setting. To be used if only logs are supported by the resource provider.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "lockType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of lock."
-                  }
-                },
-                "kind": {
-                  "type": "string",
-                  "allowedValues": [
-                    "CanNotDelete",
-                    "None",
-                    "ReadOnly"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a lock.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "roleAssignmentType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                  }
-                },
-                "roleDefinitionIdOrName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                  }
-                },
-                "principalId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                  }
-                },
-                "principalType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Device",
-                    "ForeignGroup",
-                    "Group",
-                    "ServicePrincipal",
-                    "User"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The principal type of the assigned principal ID."
-                  }
-                },
-                "description": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The description of the role assignment."
-                  }
-                },
-                "condition": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                  }
-                },
-                "conditionVersion": {
-                  "type": "string",
-                  "allowedValues": [
-                    "2.0"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Version of the condition."
-                  }
-                },
-                "delegatedManagedIdentityResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a role assignment.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. Name of the Network Security Group."
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional. Location for all resources."
-              }
-            },
-            "securityRules": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/securityRuleType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of Security Rules to deploy to the Network Security Group. When not provided, an NSG including only the built-in roles will be deployed."
-              }
-            },
-            "flushConnection": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. When enabled, flows created from Network Security Group connections will be re-evaluated when rules are updates. Initial enablement will trigger re-evaluation. Network Security Group connection flushing is not available in all regions."
-              }
-            },
-            "diagnosticSettings": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/diagnosticSettingLogsOnlyType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The diagnostic settings of the service."
-              }
-            },
-            "lock": {
-              "$ref": "#/definitions/lockType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The lock settings of the service."
-              }
-            },
-            "roleAssignments": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/roleAssignmentType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of role assignments to create."
-              }
-            },
-            "tags": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Tags of the NSG resource."
-              }
-            },
-            "enableTelemetry": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Enable/Disable usage telemetry for module."
-              }
-            }
-          },
-          "variables": {
-            "copy": [
-              {
-                "name": "formattedRoleAssignments",
-                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-              }
-            ],
-            "builtInRoleNames": {
-              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-            }
-          },
-          "resources": {
-            "avmTelemetry": {
-              "condition": "[parameters('enableTelemetry')]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-networksecuritygroup.{0}.{1}', replace('0.5.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-              "properties": {
-                "mode": "Incremental",
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "resources": [],
-                  "outputs": {
-                    "telemetry": {
-                      "type": "String",
-                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                    }
-                  }
-                }
-              }
-            },
-            "networkSecurityGroup": {
-              "type": "Microsoft.Network/networkSecurityGroups",
-              "apiVersion": "2023-11-01",
-              "name": "[parameters('name')]",
-              "location": "[parameters('location')]",
-              "tags": "[parameters('tags')]",
-              "properties": {
-                "copy": [
-                  {
-                    "name": "securityRules",
-                    "count": "[length(coalesce(parameters('securityRules'), createArray()))]",
-                    "input": {
-                      "name": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].name]",
-                      "properties": {
-                        "access": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.access]",
-                        "description": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'description'), '')]",
-                        "destinationAddressPrefix": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationAddressPrefix'), '')]",
-                        "destinationAddressPrefixes": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationAddressPrefixes'), createArray())]",
-                        "destinationApplicationSecurityGroups": "[map(coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationApplicationSecurityGroupResourceIds'), createArray()), lambda('destinationApplicationSecurityGroupResourceId', createObject('id', lambdaVariables('destinationApplicationSecurityGroupResourceId'))))]",
-                        "destinationPortRange": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationPortRange'), '')]",
-                        "destinationPortRanges": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationPortRanges'), createArray())]",
-                        "direction": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.direction]",
-                        "priority": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.priority]",
-                        "protocol": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.protocol]",
-                        "sourceAddressPrefix": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceAddressPrefix'), '')]",
-                        "sourceAddressPrefixes": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceAddressPrefixes'), createArray())]",
-                        "sourceApplicationSecurityGroups": "[map(coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceApplicationSecurityGroupResourceIds'), createArray()), lambda('sourceApplicationSecurityGroupResourceId', createObject('id', lambdaVariables('sourceApplicationSecurityGroupResourceId'))))]",
-                        "sourcePortRange": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourcePortRange'), '')]",
-                        "sourcePortRanges": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourcePortRanges'), createArray())]"
-                      }
-                    }
-                  }
-                ],
-                "flushConnection": "[parameters('flushConnection')]"
-              }
-            },
-            "networkSecurityGroup_lock": {
-              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-              "type": "Microsoft.Authorization/locks",
-              "apiVersion": "2020-05-01",
-              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-              "properties": {
-                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-              },
-              "dependsOn": [
-                "networkSecurityGroup"
-              ]
-            },
-            "networkSecurityGroup_diagnosticSettings": {
-              "copy": {
-                "name": "networkSecurityGroup_diagnosticSettings",
-                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-              },
-              "type": "Microsoft.Insights/diagnosticSettings",
-              "apiVersion": "2021-05-01-preview",
-              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-              "properties": {
-                "copy": [
-                  {
-                    "name": "logs",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                    "input": {
-                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                    }
-                  }
-                ],
-                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-              },
-              "dependsOn": [
-                "networkSecurityGroup"
-              ]
-            },
-            "networkSecurityGroup_roleAssignments": {
-              "copy": {
-                "name": "networkSecurityGroup_roleAssignments",
-                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-              },
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/networkSecurityGroups', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-              "properties": {
-                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-              },
-              "dependsOn": [
-                "networkSecurityGroup"
-              ]
-            }
-          },
-          "outputs": {
-            "resourceGroupName": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource group the network security group was deployed into."
-              },
-              "value": "[resourceGroup().name]"
-            },
-            "resourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource ID of the network security group."
-              },
-              "value": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]"
-            },
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the network security group."
-              },
-              "value": "[parameters('name')]"
-            },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "The location the resource was deployed into."
-              },
-              "value": "[reference('networkSecurityGroup', '2023-11-01', 'full').location]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "logAnalyticsWorkspace"
-      ]
-    },
-    "virtualNetwork": {
-      "condition": "[variables('virtualNetworkEnabled')]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2022-09-01",
-      "name": "[take(format('avm.res.network.virtual-network.{0}', variables('virtualNetworkResourceName')), 64)]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[variables('virtualNetworkResourceName')]"
-          },
-          "location": {
-            "value": "[coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'location'), parameters('solutionLocation'))]"
-          },
-          "tags": {
-            "value": "[coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'tags'), parameters('tags'))]"
-          },
-          "enableTelemetry": {
-            "value": "[parameters('enableTelemetry')]"
-          },
-          "addressPrefixes": {
-            "value": "[coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'addressPrefixes'), createArray('10.0.0.0/8'))]"
-          },
-          "subnets": {
-            "value": "[coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'subnets'), createArray(createObject('name', 'backend', 'addressPrefix', '10.0.0.0/27', 'networkSecurityGroupResourceId', reference('networkSecurityGroupBackend').outputs.resourceId.value), createObject('name', 'administration', 'addressPrefix', '10.0.0.32/27', 'networkSecurityGroupResourceId', reference('networkSecurityGroupAdministration').outputs.resourceId.value), createObject('name', 'AzureBastionSubnet', 'addressPrefix', '10.0.0.64/26', 'networkSecurityGroupResourceId', reference('networkSecurityGroupBastion').outputs.resourceId.value), createObject('name', 'containers', 'addressPrefix', '10.0.2.0/23', 'delegation', 'Microsoft.App/environments', 'networkSecurityGroupResourceId', reference('networkSecurityGroupContainers').outputs.resourceId.value, 'privateEndpointNetworkPolicies', 'Disabled', 'privateLinkServiceNetworkPolicies', 'Enabled')))]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.34.1.11899",
-              "templateHash": "4090376738500728310"
-            },
-            "name": "Virtual Networks",
-            "description": "This module deploys a Virtual Network (vNet)."
-          },
-          "definitions": {
-            "peeringType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The Name of VNET Peering resource. If not provided, default value will be peer-localVnetName-remoteVnetName."
-                  }
-                },
-                "remoteVirtualNetworkResourceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The Resource ID of the VNet that is this Local VNet is being peered to. Should be in the format of a Resource ID."
-                  }
-                },
-                "allowForwardedTraffic": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Whether the forwarded traffic from the VMs in the local virtual network will be allowed/disallowed in remote virtual network. Default is true."
-                  }
-                },
-                "allowGatewayTransit": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. If gateway links can be used in remote virtual networking to link to this virtual network. Default is false."
-                  }
-                },
-                "allowVirtualNetworkAccess": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Whether the VMs in the local virtual network space would be able to access the VMs in remote virtual network space. Default is true."
-                  }
-                },
-                "doNotVerifyRemoteGateways": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Do not verify the provisioning state of the remote gateway. Default is true."
-                  }
-                },
-                "useRemoteGateways": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. If remote gateways can be used on this virtual network. If the flag is set to true, and allowGatewayTransit on remote peering is also true, virtual network will use gateways of remote virtual network for transit. Only one peering can have this flag set to true. This flag cannot be set if virtual network already has a gateway. Default is false."
-                  }
-                },
-                "remotePeeringEnabled": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Deploy the outbound and the inbound peering."
-                  }
-                },
-                "remotePeeringName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the VNET Peering resource in the remove Virtual Network. If not provided, default value will be peer-remoteVnetName-localVnetName."
-                  }
-                },
-                "remotePeeringAllowForwardedTraffic": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Whether the forwarded traffic from the VMs in the local virtual network will be allowed/disallowed in remote virtual network. Default is true."
-                  }
-                },
-                "remotePeeringAllowGatewayTransit": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. If gateway links can be used in remote virtual networking to link to this virtual network. Default is false."
-                  }
-                },
-                "remotePeeringAllowVirtualNetworkAccess": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Whether the VMs in the local virtual network space would be able to access the VMs in remote virtual network space. Default is true."
-                  }
-                },
-                "remotePeeringDoNotVerifyRemoteGateways": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Do not verify the provisioning state of the remote gateway. Default is true."
-                  }
-                },
-                "remotePeeringUseRemoteGateways": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. If remote gateways can be used on this virtual network. If the flag is set to true, and allowGatewayTransit on remote peering is also true, virtual network will use gateways of remote virtual network for transit. Only one peering can have this flag set to true. This flag cannot be set if virtual network already has a gateway. Default is false."
-                  }
-                }
-              }
-            },
-            "subnetType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The Name of the subnet resource."
-                  }
-                },
-                "addressPrefix": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Conditional. The address prefix for the subnet. Required if `addressPrefixes` is empty."
-                  }
-                },
-                "addressPrefixes": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Conditional. List of address prefixes for the subnet. Required if `addressPrefix` is empty."
-                  }
-                },
-                "applicationGatewayIPConfigurations": {
-                  "type": "array",
-                  "items": {
-                    "type": "object"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Application gateway IP configurations of virtual network resource."
-                  }
-                },
-                "delegation": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The delegation to enable on the subnet."
-                  }
-                },
-                "natGatewayResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource ID of the NAT Gateway to use for the subnet."
-                  }
-                },
-                "networkSecurityGroupResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource ID of the network security group to assign to the subnet."
-                  }
-                },
-                "privateEndpointNetworkPolicies": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Disabled",
-                    "Enabled",
-                    "NetworkSecurityGroupEnabled",
-                    "RouteTableEnabled"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. enable or disable apply network policies on private endpoint in the subnet."
-                  }
-                },
-                "privateLinkServiceNetworkPolicies": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Disabled",
-                    "Enabled"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. enable or disable apply network policies on private link service in the subnet."
-                  }
-                },
-                "roleAssignments": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/roleAssignmentType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Array of role assignments to create."
-                  }
-                },
-                "routeTableResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource ID of the route table to assign to the subnet."
-                  }
-                },
-                "serviceEndpointPolicies": {
-                  "type": "array",
-                  "items": {
-                    "type": "object"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. An array of service endpoint policies."
-                  }
-                },
-                "serviceEndpoints": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The service endpoints to enable on the subnet."
-                  }
-                },
-                "defaultOutboundAccess": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Set this property to false to disable default outbound connectivity for all VMs in the subnet. This property can only be set at the time of subnet creation and cannot be updated for an existing subnet."
-                  }
-                },
-                "sharingScope": {
-                  "type": "string",
-                  "allowedValues": [
-                    "DelegatedServices",
-                    "Tenant"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Set this property to Tenant to allow sharing subnet with other subscriptions in your AAD tenant. This property can only be set if defaultOutboundAccess is set to false, both properties can only be set if subnet is empty."
-                  }
-                }
-              }
-            },
-            "diagnosticSettingFullType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the diagnostic setting."
-                  }
-                },
-                "logCategoriesAndGroups": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                        }
-                      },
-                      "categoryGroup": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                        }
-                      },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                  }
-                },
-                "metricCategories": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                        }
-                      },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                  }
-                },
-                "logAnalyticsDestinationType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "AzureDiagnostics",
-                    "Dedicated"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                  }
-                },
-                "workspaceResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "storageAccountResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "eventHubAuthorizationRuleResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                  }
-                },
-                "eventHubName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "marketplacePartnerResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
-                }
-              }
-            },
-            "lockType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of lock."
-                  }
-                },
-                "kind": {
-                  "type": "string",
-                  "allowedValues": [
-                    "CanNotDelete",
-                    "None",
-                    "ReadOnly"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a lock.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
-                }
-              }
-            },
-            "roleAssignmentType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                  }
-                },
-                "roleDefinitionIdOrName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                  }
-                },
-                "principalId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                  }
-                },
-                "principalType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Device",
-                    "ForeignGroup",
-                    "Group",
-                    "ServicePrincipal",
-                    "User"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The principal type of the assigned principal ID."
-                  }
-                },
-                "description": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The description of the role assignment."
-                  }
-                },
-                "condition": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                  }
-                },
-                "conditionVersion": {
-                  "type": "string",
-                  "allowedValues": [
-                    "2.0"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Version of the condition."
-                  }
-                },
-                "delegatedManagedIdentityResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a role assignment.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
-                }
-              }
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. The name of the Virtual Network (vNet)."
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional. Location for all resources."
-              }
-            },
-            "addressPrefixes": {
-              "type": "array",
-              "metadata": {
-                "description": "Required. An Array of 1 or more IP Address Prefixes for the Virtual Network."
-              }
-            },
-            "virtualNetworkBgpCommunity": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The BGP community associated with the virtual network."
-              }
-            },
-            "subnets": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/subnetType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. An Array of subnets to deploy to the Virtual Network."
-              }
-            },
-            "dnsServers": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. DNS Servers associated to the Virtual Network."
-              }
-            },
-            "ddosProtectionPlanResourceId": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Resource ID of the DDoS protection plan to assign the VNET to. If it's left blank, DDoS protection will not be configured. If it's provided, the VNET created by this template will be attached to the referenced DDoS protection plan. The DDoS protection plan can exist in the same or in a different subscription."
-              }
-            },
-            "peerings": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/peeringType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Virtual Network Peering configurations."
-              }
-            },
-            "vnetEncryption": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Indicates if encryption is enabled on virtual network and if VM without encryption is allowed in encrypted VNet. Requires the EnableVNetEncryption feature to be registered for the subscription and a supported region to use this property."
-              }
-            },
-            "vnetEncryptionEnforcement": {
-              "type": "string",
-              "defaultValue": "AllowUnencrypted",
-              "allowedValues": [
-                "AllowUnencrypted",
-                "DropUnencrypted"
-              ],
-              "metadata": {
-                "description": "Optional. If the encrypted VNet allows VM that does not support encryption. Can only be used when vnetEncryption is enabled."
-              }
-            },
-            "flowTimeoutInMinutes": {
-              "type": "int",
-              "defaultValue": 0,
-              "maxValue": 30,
-              "metadata": {
-                "description": "Optional. The flow timeout in minutes for the Virtual Network, which is used to enable connection tracking for intra-VM flows. Possible values are between 4 and 30 minutes. Default value 0 will set the property to null."
-              }
-            },
-            "diagnosticSettings": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/diagnosticSettingFullType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The diagnostic settings of the service."
-              }
-            },
-            "lock": {
-              "$ref": "#/definitions/lockType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The lock settings of the service."
-              }
-            },
-            "roleAssignments": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/roleAssignmentType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of role assignments to create."
-              }
-            },
-            "tags": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Tags of the resource."
-              }
-            },
-            "enableTelemetry": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Enable/Disable usage telemetry for module."
-              }
-            },
-            "enableVmProtection": {
-              "type": "bool",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Indicates if VM protection is enabled for all the subnets in the virtual network."
-              }
-            }
-          },
-          "variables": {
-            "copy": [
-              {
-                "name": "formattedRoleAssignments",
-                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-              }
-            ],
-            "enableReferencedModulesTelemetry": false,
-            "builtInRoleNames": {
-              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-            }
-          },
-          "resources": {
-            "avmTelemetry": {
-              "condition": "[parameters('enableTelemetry')]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-virtualnetwork.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-              "properties": {
-                "mode": "Incremental",
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "resources": [],
-                  "outputs": {
-                    "telemetry": {
-                      "type": "String",
-                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                    }
-                  }
-                }
-              }
-            },
-            "virtualNetwork": {
-              "type": "Microsoft.Network/virtualNetworks",
-              "apiVersion": "2024-01-01",
-              "name": "[parameters('name')]",
-              "location": "[parameters('location')]",
-              "tags": "[parameters('tags')]",
-              "properties": {
-                "addressSpace": {
-                  "addressPrefixes": "[parameters('addressPrefixes')]"
-                },
-                "bgpCommunities": "[if(not(empty(parameters('virtualNetworkBgpCommunity'))), createObject('virtualNetworkCommunity', parameters('virtualNetworkBgpCommunity')), null())]",
-                "ddosProtectionPlan": "[if(not(empty(parameters('ddosProtectionPlanResourceId'))), createObject('id', parameters('ddosProtectionPlanResourceId')), null())]",
-                "dhcpOptions": "[if(not(empty(parameters('dnsServers'))), createObject('dnsServers', array(parameters('dnsServers'))), null())]",
-                "enableDdosProtection": "[not(empty(parameters('ddosProtectionPlanResourceId')))]",
-                "encryption": "[if(equals(parameters('vnetEncryption'), true()), createObject('enabled', parameters('vnetEncryption'), 'enforcement', parameters('vnetEncryptionEnforcement')), null())]",
-                "flowTimeoutInMinutes": "[if(not(equals(parameters('flowTimeoutInMinutes'), 0)), parameters('flowTimeoutInMinutes'), null())]",
-                "enableVmProtection": "[parameters('enableVmProtection')]"
-              }
-            },
-            "virtualNetwork_lock": {
-              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-              "type": "Microsoft.Authorization/locks",
-              "apiVersion": "2020-05-01",
-              "scope": "[format('Microsoft.Network/virtualNetworks/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-              "properties": {
-                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-              },
-              "dependsOn": [
-                "virtualNetwork"
-              ]
-            },
-            "virtualNetwork_diagnosticSettings": {
-              "copy": {
-                "name": "virtualNetwork_diagnosticSettings",
-                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-              },
-              "type": "Microsoft.Insights/diagnosticSettings",
-              "apiVersion": "2021-05-01-preview",
-              "scope": "[format('Microsoft.Network/virtualNetworks/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-              "properties": {
-                "copy": [
-                  {
-                    "name": "metrics",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                    "input": {
-                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                      "timeGrain": null
-                    }
-                  },
-                  {
-                    "name": "logs",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                    "input": {
-                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                    }
-                  }
-                ],
-                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-              },
-              "dependsOn": [
-                "virtualNetwork"
-              ]
-            },
-            "virtualNetwork_roleAssignments": {
-              "copy": {
-                "name": "virtualNetwork_roleAssignments",
-                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-              },
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[format('Microsoft.Network/virtualNetworks/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/virtualNetworks', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-              "properties": {
-                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-              },
-              "dependsOn": [
-                "virtualNetwork"
-              ]
-            },
-            "virtualNetwork_subnets": {
-              "copy": {
-                "name": "virtualNetwork_subnets",
-                "count": "[length(coalesce(parameters('subnets'), createArray()))]",
-                "mode": "serial",
-                "batchSize": 1
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-subnet-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "virtualNetworkName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(parameters('subnets'), createArray())[copyIndex()].name]"
-                  },
-                  "addressPrefix": {
-                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'addressPrefix')]"
-                  },
-                  "addressPrefixes": {
-                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'addressPrefixes')]"
-                  },
-                  "applicationGatewayIPConfigurations": {
-                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'applicationGatewayIPConfigurations')]"
-                  },
-                  "delegation": {
-                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'delegation')]"
-                  },
-                  "natGatewayResourceId": {
-                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'natGatewayResourceId')]"
-                  },
-                  "networkSecurityGroupResourceId": {
-                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'networkSecurityGroupResourceId')]"
-                  },
-                  "privateEndpointNetworkPolicies": {
-                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'privateEndpointNetworkPolicies')]"
-                  },
-                  "privateLinkServiceNetworkPolicies": {
-                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'privateLinkServiceNetworkPolicies')]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'roleAssignments')]"
-                  },
-                  "routeTableResourceId": {
-                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'routeTableResourceId')]"
-                  },
-                  "serviceEndpointPolicies": {
-                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'serviceEndpointPolicies')]"
-                  },
-                  "serviceEndpoints": {
-                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'serviceEndpoints')]"
-                  },
-                  "defaultOutboundAccess": {
-                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'defaultOutboundAccess')]"
-                  },
-                  "sharingScope": {
-                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'sharingScope')]"
-                  },
-                  "enableTelemetry": {
-                    "value": "[variables('enableReferencedModulesTelemetry')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.1.11899",
-                      "templateHash": "2692730101868032103"
-                    },
-                    "name": "Virtual Network Subnets",
-                    "description": "This module deploys a Virtual Network Subnet."
-                  },
-                  "definitions": {
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The Name of the subnet resource."
-                      }
-                    },
-                    "virtualNetworkName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent virtual network. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "addressPrefix": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Conditional. The address prefix for the subnet. Required if `addressPrefixes` is empty."
-                      }
-                    },
-                    "networkSecurityGroupResourceId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The resource ID of the network security group to assign to the subnet."
-                      }
-                    },
-                    "routeTableResourceId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The resource ID of the route table to assign to the subnet."
-                      }
-                    },
-                    "serviceEndpoints": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "defaultValue": [],
-                      "metadata": {
-                        "description": "Optional. The service endpoints to enable on the subnet."
-                      }
-                    },
-                    "delegation": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The delegation to enable on the subnet."
-                      }
-                    },
-                    "natGatewayResourceId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The resource ID of the NAT Gateway to use for the subnet."
-                      }
-                    },
-                    "privateEndpointNetworkPolicies": {
-                      "type": "string",
-                      "nullable": true,
-                      "allowedValues": [
-                        "Disabled",
-                        "Enabled",
-                        "NetworkSecurityGroupEnabled",
-                        "RouteTableEnabled"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Enable or disable apply network policies on private endpoint in the subnet."
-                      }
-                    },
-                    "privateLinkServiceNetworkPolicies": {
-                      "type": "string",
-                      "nullable": true,
-                      "allowedValues": [
-                        "Disabled",
-                        "Enabled"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Enable or disable apply network policies on private link service in the subnet."
-                      }
-                    },
-                    "addressPrefixes": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Conditional. List of address prefixes for the subnet. Required if `addressPrefix` is empty."
-                      }
-                    },
-                    "defaultOutboundAccess": {
-                      "type": "bool",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Set this property to false to disable default outbound connectivity for all VMs in the subnet. This property can only be set at the time of subnet creation and cannot be updated for an existing subnet."
-                      }
-                    },
-                    "sharingScope": {
-                      "type": "string",
-                      "allowedValues": [
-                        "DelegatedServices",
-                        "Tenant"
-                      ],
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Set this property to Tenant to allow sharing the subnet with other subscriptions in your AAD tenant. This property can only be set if defaultOutboundAccess is set to false, both properties can only be set if the subnet is empty."
-                      }
-                    },
-                    "applicationGatewayIPConfigurations": {
-                      "type": "array",
-                      "defaultValue": [],
-                      "metadata": {
-                        "description": "Optional. Application gateway IP configurations of virtual network resource."
-                      }
-                    },
-                    "serviceEndpointPolicies": {
-                      "type": "array",
-                      "defaultValue": [],
-                      "metadata": {
-                        "description": "Optional. An array of service endpoint policies."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    },
-                    "enableTelemetry": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Enable/Disable usage telemetry for module."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "avmTelemetry": {
-                      "condition": "[parameters('enableTelemetry')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2024-03-01",
-                      "name": "[format('46d3xbcp.res.network-virtualnetworksubnet.{0}.{1}', replace('0.1.1', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
-                      "properties": {
-                        "mode": "Incremental",
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "resources": [],
-                          "outputs": {
-                            "telemetry": {
-                              "type": "String",
-                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "virtualNetwork": {
-                      "existing": true,
-                      "type": "Microsoft.Network/virtualNetworks",
-                      "apiVersion": "2024-01-01",
-                      "name": "[parameters('virtualNetworkName')]"
-                    },
-                    "subnet": {
-                      "type": "Microsoft.Network/virtualNetworks/subnets",
-                      "apiVersion": "2024-01-01",
-                      "name": "[format('{0}/{1}', parameters('virtualNetworkName'), parameters('name'))]",
-                      "properties": {
-                        "copy": [
-                          {
-                            "name": "serviceEndpoints",
-                            "count": "[length(parameters('serviceEndpoints'))]",
-                            "input": {
-                              "service": "[parameters('serviceEndpoints')[copyIndex('serviceEndpoints')]]"
-                            }
-                          }
-                        ],
-                        "addressPrefix": "[parameters('addressPrefix')]",
-                        "addressPrefixes": "[parameters('addressPrefixes')]",
-                        "networkSecurityGroup": "[if(not(empty(parameters('networkSecurityGroupResourceId'))), createObject('id', parameters('networkSecurityGroupResourceId')), null())]",
-                        "routeTable": "[if(not(empty(parameters('routeTableResourceId'))), createObject('id', parameters('routeTableResourceId')), null())]",
-                        "natGateway": "[if(not(empty(parameters('natGatewayResourceId'))), createObject('id', parameters('natGatewayResourceId')), null())]",
-                        "delegations": "[if(not(empty(parameters('delegation'))), createArray(createObject('name', parameters('delegation'), 'properties', createObject('serviceName', parameters('delegation')))), createArray())]",
-                        "privateEndpointNetworkPolicies": "[parameters('privateEndpointNetworkPolicies')]",
-                        "privateLinkServiceNetworkPolicies": "[parameters('privateLinkServiceNetworkPolicies')]",
-                        "applicationGatewayIPConfigurations": "[parameters('applicationGatewayIPConfigurations')]",
-                        "serviceEndpointPolicies": "[parameters('serviceEndpointPolicies')]",
-                        "defaultOutboundAccess": "[parameters('defaultOutboundAccess')]",
-                        "sharingScope": "[parameters('sharingScope')]"
-                      }
-                    },
-                    "subnet_roleAssignments": {
-                      "copy": {
-                        "name": "subnet_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/virtualNetworks/{0}/subnets/{1}', parameters('virtualNetworkName'), parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "subnet"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group the virtual network peering was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the virtual network peering."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the virtual network peering."
-                      },
-                      "value": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('name'))]"
-                    },
-                    "addressPrefix": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The address prefix for the subnet."
-                      },
-                      "value": "[coalesce(tryGet(reference('subnet'), 'addressPrefix'), '')]"
-                    },
-                    "addressPrefixes": {
-                      "type": "array",
-                      "metadata": {
-                        "description": "List of address prefixes for the subnet."
-                      },
-                      "value": "[coalesce(tryGet(reference('subnet'), 'addressPrefixes'), createArray())]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "virtualNetwork"
-              ]
-            },
-            "virtualNetwork_peering_local": {
-              "copy": {
-                "name": "virtualNetwork_peering_local",
-                "count": "[length(coalesce(parameters('peerings'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-virtualNetworkPeering-local-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "localVnetName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "remoteVirtualNetworkResourceId": {
-                    "value": "[coalesce(parameters('peerings'), createArray())[copyIndex()].remoteVirtualNetworkResourceId]"
-                  },
-                  "name": {
-                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'name')]"
-                  },
-                  "allowForwardedTraffic": {
-                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'allowForwardedTraffic')]"
-                  },
-                  "allowGatewayTransit": {
-                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'allowGatewayTransit')]"
-                  },
-                  "allowVirtualNetworkAccess": {
-                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'allowVirtualNetworkAccess')]"
-                  },
-                  "doNotVerifyRemoteGateways": {
-                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'doNotVerifyRemoteGateways')]"
-                  },
-                  "useRemoteGateways": {
-                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'useRemoteGateways')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.1.11899",
-                      "templateHash": "7728525434782883754"
-                    },
-                    "name": "Virtual Network Peerings",
-                    "description": "This module deploys a Virtual Network Peering."
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "defaultValue": "[format('peer-{0}-{1}', parameters('localVnetName'), last(split(parameters('remoteVirtualNetworkResourceId'), '/')))]",
-                      "metadata": {
-                        "description": "Optional. The Name of VNET Peering resource. If not provided, default value will be localVnetName-remoteVnetName."
-                      }
-                    },
-                    "localVnetName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Virtual Network to add the peering to. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "remoteVirtualNetworkResourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The Resource ID of the VNet that is this Local VNet is being peered to. Should be in the format of a Resource ID."
-                      }
-                    },
-                    "allowForwardedTraffic": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Whether the forwarded traffic from the VMs in the local virtual network will be allowed/disallowed in remote virtual network. Default is true."
-                      }
-                    },
-                    "allowGatewayTransit": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. If gateway links can be used in remote virtual networking to link to this virtual network. Default is false."
-                      }
-                    },
-                    "allowVirtualNetworkAccess": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Whether the VMs in the local virtual network space would be able to access the VMs in remote virtual network space. Default is true."
-                      }
-                    },
-                    "doNotVerifyRemoteGateways": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. If we need to verify the provisioning state of the remote gateway. Default is true."
-                      }
-                    },
-                    "useRemoteGateways": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. If remote gateways can be used on this virtual network. If the flag is set to true, and allowGatewayTransit on remote peering is also true, virtual network will use gateways of remote virtual network for transit. Only one peering can have this flag set to true. This flag cannot be set if virtual network already has a gateway. Default is false."
-                      }
-                    }
-                  },
-                  "resources": [
-                    {
-                      "type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",
-                      "apiVersion": "2024-01-01",
-                      "name": "[format('{0}/{1}', parameters('localVnetName'), parameters('name'))]",
-                      "properties": {
-                        "allowForwardedTraffic": "[parameters('allowForwardedTraffic')]",
-                        "allowGatewayTransit": "[parameters('allowGatewayTransit')]",
-                        "allowVirtualNetworkAccess": "[parameters('allowVirtualNetworkAccess')]",
-                        "doNotVerifyRemoteGateways": "[parameters('doNotVerifyRemoteGateways')]",
-                        "useRemoteGateways": "[parameters('useRemoteGateways')]",
-                        "remoteVirtualNetwork": {
-                          "id": "[parameters('remoteVirtualNetworkResourceId')]"
-                        }
-                      }
-                    }
-                  ],
-                  "outputs": {
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group the virtual network peering was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the virtual network peering."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the virtual network peering."
-                      },
-                      "value": "[resourceId('Microsoft.Network/virtualNetworks/virtualNetworkPeerings', parameters('localVnetName'), parameters('name'))]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "virtualNetwork",
-                "virtualNetwork_subnets"
-              ]
-            },
-            "virtualNetwork_peering_remote": {
-              "copy": {
-                "name": "virtualNetwork_peering_remote",
-                "count": "[length(coalesce(parameters('peerings'), createArray()))]"
-              },
-              "condition": "[coalesce(tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringEnabled'), false())]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-virtualNetworkPeering-remote-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "subscriptionId": "[split(coalesce(parameters('peerings'), createArray())[copyIndex()].remoteVirtualNetworkResourceId, '/')[2]]",
-              "resourceGroup": "[split(coalesce(parameters('peerings'), createArray())[copyIndex()].remoteVirtualNetworkResourceId, '/')[4]]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "localVnetName": {
-                    "value": "[last(split(coalesce(parameters('peerings'), createArray())[copyIndex()].remoteVirtualNetworkResourceId, '/'))]"
-                  },
-                  "remoteVirtualNetworkResourceId": {
-                    "value": "[resourceId('Microsoft.Network/virtualNetworks', parameters('name'))]"
-                  },
-                  "name": {
-                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringName')]"
-                  },
-                  "allowForwardedTraffic": {
-                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringAllowForwardedTraffic')]"
-                  },
-                  "allowGatewayTransit": {
-                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringAllowGatewayTransit')]"
-                  },
-                  "allowVirtualNetworkAccess": {
-                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringAllowVirtualNetworkAccess')]"
-                  },
-                  "doNotVerifyRemoteGateways": {
-                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringDoNotVerifyRemoteGateways')]"
-                  },
-                  "useRemoteGateways": {
-                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringUseRemoteGateways')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.1.11899",
-                      "templateHash": "7728525434782883754"
-                    },
-                    "name": "Virtual Network Peerings",
-                    "description": "This module deploys a Virtual Network Peering."
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "defaultValue": "[format('peer-{0}-{1}', parameters('localVnetName'), last(split(parameters('remoteVirtualNetworkResourceId'), '/')))]",
-                      "metadata": {
-                        "description": "Optional. The Name of VNET Peering resource. If not provided, default value will be localVnetName-remoteVnetName."
-                      }
-                    },
-                    "localVnetName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Virtual Network to add the peering to. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "remoteVirtualNetworkResourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The Resource ID of the VNet that is this Local VNet is being peered to. Should be in the format of a Resource ID."
-                      }
-                    },
-                    "allowForwardedTraffic": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Whether the forwarded traffic from the VMs in the local virtual network will be allowed/disallowed in remote virtual network. Default is true."
-                      }
-                    },
-                    "allowGatewayTransit": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. If gateway links can be used in remote virtual networking to link to this virtual network. Default is false."
-                      }
-                    },
-                    "allowVirtualNetworkAccess": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Whether the VMs in the local virtual network space would be able to access the VMs in remote virtual network space. Default is true."
-                      }
-                    },
-                    "doNotVerifyRemoteGateways": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. If we need to verify the provisioning state of the remote gateway. Default is true."
-                      }
-                    },
-                    "useRemoteGateways": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. If remote gateways can be used on this virtual network. If the flag is set to true, and allowGatewayTransit on remote peering is also true, virtual network will use gateways of remote virtual network for transit. Only one peering can have this flag set to true. This flag cannot be set if virtual network already has a gateway. Default is false."
-                      }
-                    }
-                  },
-                  "resources": [
-                    {
-                      "type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",
-                      "apiVersion": "2024-01-01",
-                      "name": "[format('{0}/{1}', parameters('localVnetName'), parameters('name'))]",
-                      "properties": {
-                        "allowForwardedTraffic": "[parameters('allowForwardedTraffic')]",
-                        "allowGatewayTransit": "[parameters('allowGatewayTransit')]",
-                        "allowVirtualNetworkAccess": "[parameters('allowVirtualNetworkAccess')]",
-                        "doNotVerifyRemoteGateways": "[parameters('doNotVerifyRemoteGateways')]",
-                        "useRemoteGateways": "[parameters('useRemoteGateways')]",
-                        "remoteVirtualNetwork": {
-                          "id": "[parameters('remoteVirtualNetworkResourceId')]"
-                        }
-                      }
-                    }
-                  ],
-                  "outputs": {
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group the virtual network peering was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the virtual network peering."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the virtual network peering."
-                      },
-                      "value": "[resourceId('Microsoft.Network/virtualNetworks/virtualNetworkPeerings', parameters('localVnetName'), parameters('name'))]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "virtualNetwork",
-                "virtualNetwork_subnets"
-              ]
-            }
-          },
-          "outputs": {
-            "resourceGroupName": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource group the virtual network was deployed into."
-              },
-              "value": "[resourceGroup().name]"
-            },
-            "resourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource ID of the virtual network."
-              },
-              "value": "[resourceId('Microsoft.Network/virtualNetworks', parameters('name'))]"
-            },
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the virtual network."
-              },
-              "value": "[parameters('name')]"
-            },
-            "subnetNames": {
-              "type": "array",
-              "metadata": {
-                "description": "The names of the deployed subnets."
-              },
-              "copy": {
-                "count": "[length(coalesce(parameters('subnets'), createArray()))]",
-                "input": "[reference(format('virtualNetwork_subnets[{0}]', copyIndex())).outputs.name.value]"
-              }
-            },
-            "subnetResourceIds": {
-              "type": "array",
-              "metadata": {
-                "description": "The resource IDs of the deployed subnets."
-              },
-              "copy": {
-                "count": "[length(coalesce(parameters('subnets'), createArray()))]",
-                "input": "[reference(format('virtualNetwork_subnets[{0}]', copyIndex())).outputs.resourceId.value]"
-              }
-            },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "The location the resource was deployed into."
-              },
-              "value": "[reference('virtualNetwork', '2024-01-01', 'full').location]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "networkSecurityGroupAdministration",
-        "networkSecurityGroupBackend",
-        "networkSecurityGroupBastion",
-        "networkSecurityGroupContainers"
-      ]
-    },
-    "bastionHost": {
-      "condition": "[and(variables('virtualNetworkEnabled'), variables('bastionEnabled'))]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2022-09-01",
-      "name": "[take(format('avm.res.network.bastion-host.{0}', variables('bastionResourceName')), 64)]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[variables('bastionResourceName')]"
-          },
-          "location": {
-            "value": "[coalesce(tryGet(parameters('bastionConfiguration'), 'location'), parameters('solutionLocation'))]"
-          },
-          "skuName": {
-            "value": "[coalesce(tryGet(parameters('bastionConfiguration'), 'sku'), 'Standard')]"
-          },
-          "enableTelemetry": {
-            "value": "[parameters('enableTelemetry')]"
-          },
-          "tags": {
-            "value": "[coalesce(tryGet(parameters('bastionConfiguration'), 'tags'), parameters('tags'))]"
-          },
-          "virtualNetworkResourceId": {
-            "value": "[coalesce(tryGet(parameters('bastionConfiguration'), 'virtualNetworkResourceId'), tryGet(tryGet(tryGet(reference('virtualNetwork'), 'outputs'), 'resourceId'), 'value'))]"
-          },
-          "publicIPAddressObject": {
-            "value": {
-              "name": "[coalesce(tryGet(parameters('bastionConfiguration'), 'publicIpResourceName'), format('pip-bas{0}', parameters('solutionPrefix')))]"
-            }
-          },
-          "disableCopyPaste": {
-            "value": false
-          },
-          "enableFileCopy": {
-            "value": false
-          },
-          "enableIpConnect": {
-            "value": true
-          },
-          "enableShareableLink": {
-            "value": true
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.33.93.31351",
-              "templateHash": "2586599138991803385"
-            },
-            "name": "Bastion Hosts",
-            "description": "This module deploys a Bastion Host."
-          },
-          "definitions": {
-            "diagnosticSettingLogsOnlyType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of diagnostic setting."
-                  }
-                },
-                "logCategoriesAndGroups": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                        }
-                      },
-                      "categoryGroup": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                        }
-                      },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                  }
-                },
-                "logAnalyticsDestinationType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "AzureDiagnostics",
-                    "Dedicated"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                  }
-                },
-                "workspaceResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "storageAccountResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "eventHubAuthorizationRuleResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                  }
-                },
-                "eventHubName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "marketplacePartnerResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a diagnostic setting. To be used if only logs are supported by the resource provider.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "lockType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of lock."
-                  }
-                },
-                "kind": {
-                  "type": "string",
-                  "allowedValues": [
-                    "CanNotDelete",
-                    "None",
-                    "ReadOnly"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a lock.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "roleAssignmentType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                  }
-                },
-                "roleDefinitionIdOrName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                  }
-                },
-                "principalId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                  }
-                },
-                "principalType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Device",
-                    "ForeignGroup",
-                    "Group",
-                    "ServicePrincipal",
-                    "User"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The principal type of the assigned principal ID."
-                  }
-                },
-                "description": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The description of the role assignment."
-                  }
-                },
-                "condition": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                  }
-                },
-                "conditionVersion": {
-                  "type": "string",
-                  "allowedValues": [
-                    "2.0"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Version of the condition."
-                  }
-                },
-                "delegatedManagedIdentityResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a role assignment.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. Name of the Azure Bastion resource."
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional. Location for all resources."
-              }
-            },
-            "virtualNetworkResourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. Shared services Virtual Network resource Id."
-              }
-            },
-            "bastionSubnetPublicIpResourceId": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. The Public IP resource ID to associate to the azureBastionSubnet. If empty, then the Public IP that is created as part of this module will be applied to the azureBastionSubnet. This parameter is ignored when enablePrivateOnlyBastion is true."
-              }
-            },
-            "publicIPAddressObject": {
-              "type": "object",
-              "defaultValue": {
-                "name": "[format('{0}-pip', parameters('name'))]"
-              },
-              "metadata": {
-                "description": "Optional. Specifies the properties of the Public IP to create and be used by Azure Bastion, if no existing public IP was provided. This parameter is ignored when enablePrivateOnlyBastion is true."
-              }
-            },
-            "diagnosticSettings": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/diagnosticSettingLogsOnlyType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The diagnostic settings of the service."
-              }
-            },
-            "lock": {
-              "$ref": "#/definitions/lockType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The lock settings of the service."
-              }
-            },
-            "skuName": {
-              "type": "string",
-              "defaultValue": "Basic",
-              "allowedValues": [
-                "Basic",
-                "Developer",
-                "Premium",
-                "Standard"
-              ],
-              "metadata": {
-                "description": "Optional. The SKU of this Bastion Host."
-              }
-            },
-            "disableCopyPaste": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Choose to disable or enable Copy Paste. For Basic and Developer SKU Copy/Paste is always enabled."
-              }
-            },
-            "enableFileCopy": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Choose to disable or enable File Copy. Not supported for Basic and Developer SKU."
-              }
-            },
-            "enableIpConnect": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Choose to disable or enable IP Connect. Not supported for Basic and Developer SKU."
-              }
-            },
-            "enableKerberos": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Choose to disable or enable Kerberos authentication. Not supported for Developer SKU."
-              }
-            },
-            "enableShareableLink": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Choose to disable or enable Shareable Link. Not supported for Basic and Developer SKU."
-              }
-            },
-            "enableSessionRecording": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Choose to disable or enable Session Recording feature. The Premium SKU is required for this feature. If Session Recording is enabled, the Native client support will be disabled."
-              }
-            },
-            "enablePrivateOnlyBastion": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Choose to disable or enable Private-only Bastion deployment. The Premium SKU is required for this feature."
-              }
-            },
-            "scaleUnits": {
-              "type": "int",
-              "defaultValue": 2,
-              "metadata": {
-                "description": "Optional. The scale units for the Bastion Host resource. The Basic and Developer SKU only support 2 scale units."
-              }
-            },
-            "roleAssignments": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/roleAssignmentType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of role assignments to create."
-              }
-            },
-            "tags": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Tags of the resource."
-              }
-            },
-            "enableTelemetry": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Enable/Disable usage telemetry for module."
-              }
-            },
-            "zones": {
-              "type": "array",
-              "items": {
-                "type": "int"
-              },
-              "defaultValue": [],
-              "allowedValues": [
-                1,
-                2,
-                3
-              ],
-              "metadata": {
-                "description": "Optional. A list of availability zones denoting where the Bastion Host resource needs to come from. This is not supported for the Developer SKU."
-              }
-            }
-          },
-          "variables": {
-            "copy": [
-              {
-                "name": "formattedRoleAssignments",
-                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-              }
-            ],
-            "enableReferencedModulesTelemetry": false,
-            "builtInRoleNames": {
-              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-            }
-          },
-          "resources": {
-            "avmTelemetry": {
-              "condition": "[parameters('enableTelemetry')]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-bastionhost.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-              "properties": {
-                "mode": "Incremental",
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "resources": [],
-                  "outputs": {
-                    "telemetry": {
-                      "type": "String",
-                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                    }
-                  }
-                }
-              }
-            },
-            "azureBastion": {
-              "type": "Microsoft.Network/bastionHosts",
-              "apiVersion": "2024-05-01",
-              "name": "[parameters('name')]",
-              "location": "[parameters('location')]",
-              "tags": "[coalesce(parameters('tags'), createObject())]",
-              "sku": {
-                "name": "[parameters('skuName')]"
-              },
-              "zones": "[if(equals(parameters('skuName'), 'Developer'), createArray(), map(parameters('zones'), lambda('zone', string(lambdaVariables('zone')))))]",
-              "properties": "[union(createObject('scaleUnits', if(or(equals(parameters('skuName'), 'Basic'), equals(parameters('skuName'), 'Developer')), 2, parameters('scaleUnits')), 'ipConfigurations', if(equals(parameters('skuName'), 'Developer'), createArray(), createArray(createObject('name', 'IpConfAzureBastionSubnet', 'properties', union(createObject('subnet', createObject('id', format('{0}/subnets/AzureBastionSubnet', parameters('virtualNetworkResourceId')))), if(not(parameters('enablePrivateOnlyBastion')), createObject('publicIPAddress', createObject('id', if(not(empty(parameters('bastionSubnetPublicIpResourceId'))), parameters('bastionSubnetPublicIpResourceId'), reference('publicIPAddress').outputs.resourceId.value))), createObject())))))), if(equals(parameters('skuName'), 'Developer'), createObject('virtualNetwork', createObject('id', parameters('virtualNetworkResourceId'))), createObject()), if(or(or(equals(parameters('skuName'), 'Basic'), equals(parameters('skuName'), 'Standard')), equals(parameters('skuName'), 'Premium')), createObject('enableKerberos', parameters('enableKerberos')), createObject()), if(or(equals(parameters('skuName'), 'Standard'), equals(parameters('skuName'), 'Premium')), createObject('enableTunneling', if(equals(parameters('skuName'), 'Standard'), true(), if(parameters('enableSessionRecording'), false(), true())), 'disableCopyPaste', parameters('disableCopyPaste'), 'enableFileCopy', parameters('enableFileCopy'), 'enableIpConnect', parameters('enableIpConnect'), 'enableShareableLink', parameters('enableShareableLink')), createObject()), if(equals(parameters('skuName'), 'Premium'), createObject('enableSessionRecording', parameters('enableSessionRecording'), 'enablePrivateOnlyBastion', parameters('enablePrivateOnlyBastion')), createObject()))]",
-              "dependsOn": [
-                "publicIPAddress"
-              ]
-            },
-            "azureBastion_lock": {
-              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-              "type": "Microsoft.Authorization/locks",
-              "apiVersion": "2020-05-01",
-              "scope": "[format('Microsoft.Network/bastionHosts/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-              "properties": {
-                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-              },
-              "dependsOn": [
-                "azureBastion"
-              ]
-            },
-            "azureBastion_diagnosticSettings": {
-              "copy": {
-                "name": "azureBastion_diagnosticSettings",
-                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-              },
-              "type": "Microsoft.Insights/diagnosticSettings",
-              "apiVersion": "2021-05-01-preview",
-              "scope": "[format('Microsoft.Network/bastionHosts/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-              "properties": {
-                "copy": [
-                  {
-                    "name": "logs",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                    "input": {
-                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                    }
-                  }
-                ],
-                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-              },
-              "dependsOn": [
-                "azureBastion"
-              ]
-            },
-            "azureBastion_roleAssignments": {
-              "copy": {
-                "name": "azureBastion_roleAssignments",
-                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-              },
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[format('Microsoft.Network/bastionHosts/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/bastionHosts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-              "properties": {
-                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-              },
-              "dependsOn": [
-                "azureBastion"
-              ]
-            },
-            "publicIPAddress": {
-              "condition": "[and(and(empty(parameters('bastionSubnetPublicIpResourceId')), not(equals(parameters('skuName'), 'Developer'))), not(parameters('enablePrivateOnlyBastion')))]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-Bastion-PIP', uniqueString(deployment().name, parameters('location')))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[parameters('publicIPAddressObject').name]"
-                  },
-                  "enableTelemetry": {
-                    "value": "[variables('enableReferencedModulesTelemetry')]"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "lock": {
-                    "value": "[parameters('lock')]"
-                  },
-                  "diagnosticSettings": {
-                    "value": "[tryGet(parameters('publicIPAddressObject'), 'diagnosticSettings')]"
-                  },
-                  "publicIPAddressVersion": {
-                    "value": "[tryGet(parameters('publicIPAddressObject'), 'publicIPAddressVersion')]"
-                  },
-                  "publicIPAllocationMethod": {
-                    "value": "[tryGet(parameters('publicIPAddressObject'), 'publicIPAllocationMethod')]"
-                  },
-                  "publicIpPrefixResourceId": {
-                    "value": "[tryGet(parameters('publicIPAddressObject'), 'publicIPPrefixResourceId')]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(parameters('publicIPAddressObject'), 'roleAssignments')]"
-                  },
-                  "skuName": {
-                    "value": "[tryGet(parameters('publicIPAddressObject'), 'skuName')]"
-                  },
-                  "skuTier": {
-                    "value": "[tryGet(parameters('publicIPAddressObject'), 'skuTier')]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(parameters('publicIPAddressObject'), 'tags'), parameters('tags'))]"
-                  },
-                  "zones": {
-                    "value": "[coalesce(tryGet(parameters('publicIPAddressObject'), 'zones'), if(greater(length(parameters('zones')), 0), parameters('zones'), null()))]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.33.93.31351",
-                      "templateHash": "5168739580767459761"
-                    },
-                    "name": "Public IP Addresses",
-                    "description": "This module deploys a Public IP Address."
-                  },
-                  "definitions": {
-                    "dnsSettingsType": {
-                      "type": "object",
-                      "properties": {
-                        "domainNameLabel": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The domain name label. The concatenation of the domain name label and the regionalized DNS zone make up the fully qualified domain name associated with the public IP address. If a domain name label is specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system."
-                          }
-                        },
-                        "domainNameLabelScope": {
-                          "type": "string",
-                          "allowedValues": [
-                            "NoReuse",
-                            "ResourceGroupReuse",
-                            "SubscriptionReuse",
-                            "TenantReuse"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The domain name label scope. If a domain name label and a domain name label scope are specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system with a hashed value includes in FQDN."
-                          }
-                        },
-                        "fqdn": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Fully Qualified Domain Name of the A DNS record associated with the public IP. This is the concatenation of the domainNameLabel and the regionalized DNS zone."
-                          }
-                        },
-                        "reverseFqdn": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The reverse FQDN. A user-visible, fully qualified domain name that resolves to this public IP address. If the reverseFqdn is specified, then a PTR DNS record is created pointing from the IP address in the in-addr.arpa domain to the reverse FQDN."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true
-                      }
-                    },
-                    "ddosSettingsType": {
-                      "type": "object",
-                      "properties": {
-                        "ddosProtectionPlan": {
-                          "type": "object",
-                          "properties": {
-                            "id": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The resource ID of the DDOS protection plan associated with the public IP address."
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The DDoS protection plan associated with the public IP address."
-                          }
-                        },
-                        "protectionMode": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Enabled"
-                          ],
-                          "metadata": {
-                            "description": "Required. The DDoS protection policy customizations."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true
-                      }
-                    },
-                    "ipTagType": {
-                      "type": "object",
-                      "properties": {
-                        "ipTagType": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The IP tag type."
-                          }
-                        },
-                        "tag": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The IP tag."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true
-                      }
-                    },
-                    "diagnosticSettingFullType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the diagnostic setting."
-                          }
-                        },
-                        "logCategoriesAndGroups": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                }
-                              },
-                              "categoryGroup": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                }
-                              },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                          }
-                        },
-                        "metricCategories": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                }
-                              },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                          }
-                        },
-                        "logAnalyticsDestinationType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "AzureDiagnostics",
-                            "Dedicated"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                          }
-                        },
-                        "workspaceResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "storageAccountResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "eventHubAuthorizationRuleResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                          }
-                        },
-                        "eventHubName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "marketplacePartnerResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
-                        }
-                      }
-                    },
-                    "lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
-                        }
-                      }
-                    },
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the Public IP Address."
-                      }
-                    },
-                    "publicIpPrefixResourceId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Resource ID of the Public IP Prefix object. This is only needed if you want your Public IPs created in a PIP Prefix."
-                      }
-                    },
-                    "publicIPAllocationMethod": {
-                      "type": "string",
-                      "defaultValue": "Static",
-                      "allowedValues": [
-                        "Dynamic",
-                        "Static"
-                      ],
-                      "metadata": {
-                        "description": "Optional. The public IP address allocation method."
-                      }
-                    },
-                    "zones": {
-                      "type": "array",
-                      "items": {
-                        "type": "int"
-                      },
-                      "defaultValue": [
-                        1,
-                        2,
-                        3
-                      ],
-                      "allowedValues": [
-                        1,
-                        2,
-                        3
-                      ],
-                      "metadata": {
-                        "description": "Optional. A list of availability zones denoting the IP allocated for the resource needs to come from."
-                      }
-                    },
-                    "publicIPAddressVersion": {
-                      "type": "string",
-                      "defaultValue": "IPv4",
-                      "allowedValues": [
-                        "IPv4",
-                        "IPv6"
-                      ],
-                      "metadata": {
-                        "description": "Optional. IP address version."
-                      }
-                    },
-                    "dnsSettings": {
-                      "$ref": "#/definitions/dnsSettingsType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The DNS settings of the public IP address."
-                      }
-                    },
-                    "ipTags": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/ipTagType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The list of tags associated with the public IP address."
-                      }
-                    },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The lock settings of the service."
-                      }
-                    },
-                    "skuName": {
-                      "type": "string",
-                      "defaultValue": "Standard",
-                      "allowedValues": [
-                        "Basic",
-                        "Standard"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Name of a public IP address SKU."
-                      }
-                    },
-                    "skuTier": {
-                      "type": "string",
-                      "defaultValue": "Regional",
-                      "allowedValues": [
-                        "Global",
-                        "Regional"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Tier of a public IP address SKU."
-                      }
-                    },
-                    "ddosSettings": {
-                      "$ref": "#/definitions/ddosSettingsType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The DDoS protection plan configuration associated with the public IP address."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all resources."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    },
-                    "enableTelemetry": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Enable/Disable usage telemetry for module."
-                      }
-                    },
-                    "idleTimeoutInMinutes": {
-                      "type": "int",
-                      "defaultValue": 4,
-                      "metadata": {
-                        "description": "Optional. The idle timeout of the public IP address."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the resource."
-                      }
-                    },
-                    "diagnosticSettings": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/diagnosticSettingFullType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The diagnostic settings of the service."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
-                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
-                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
-                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
-                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
-                    }
-                  },
-                  "resources": {
-                    "avmTelemetry": {
-                      "condition": "[parameters('enableTelemetry')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2024-03-01",
-                      "name": "[format('46d3xbcp.res.network-publicipaddress.{0}.{1}', replace('0.8.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                      "properties": {
-                        "mode": "Incremental",
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "resources": [],
-                          "outputs": {
-                            "telemetry": {
-                              "type": "String",
-                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "publicIpAddress": {
-                      "type": "Microsoft.Network/publicIPAddresses",
-                      "apiVersion": "2024-05-01",
-                      "name": "[parameters('name')]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "sku": {
-                        "name": "[parameters('skuName')]",
-                        "tier": "[parameters('skuTier')]"
-                      },
-                      "zones": "[map(parameters('zones'), lambda('zone', string(lambdaVariables('zone'))))]",
-                      "properties": {
-                        "ddosSettings": "[parameters('ddosSettings')]",
-                        "dnsSettings": "[parameters('dnsSettings')]",
-                        "publicIPAddressVersion": "[parameters('publicIPAddressVersion')]",
-                        "publicIPAllocationMethod": "[parameters('publicIPAllocationMethod')]",
-                        "publicIPPrefix": "[if(not(empty(parameters('publicIpPrefixResourceId'))), createObject('id', parameters('publicIpPrefixResourceId')), null())]",
-                        "idleTimeoutInMinutes": "[parameters('idleTimeoutInMinutes')]",
-                        "ipTags": "[parameters('ipTags')]"
-                      }
-                    },
-                    "publicIpAddress_lock": {
-                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                      "type": "Microsoft.Authorization/locks",
-                      "apiVersion": "2020-05-01",
-                      "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                      "properties": {
-                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-                      },
-                      "dependsOn": [
-                        "publicIpAddress"
-                      ]
-                    },
-                    "publicIpAddress_roleAssignments": {
-                      "copy": {
-                        "name": "publicIpAddress_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/publicIPAddresses', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "publicIpAddress"
-                      ]
-                    },
-                    "publicIpAddress_diagnosticSettings": {
-                      "copy": {
-                        "name": "publicIpAddress_diagnosticSettings",
-                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                      },
-                      "type": "Microsoft.Insights/diagnosticSettings",
-                      "apiVersion": "2021-05-01-preview",
-                      "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-                      "properties": {
-                        "copy": [
-                          {
-                            "name": "metrics",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                            "input": {
-                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                              "timeGrain": null
-                            }
-                          },
-                          {
-                            "name": "logs",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                            "input": {
-                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                            }
-                          }
-                        ],
-                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                      },
-                      "dependsOn": [
-                        "publicIpAddress"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group the public IP address was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the public IP address."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the public IP address."
-                      },
-                      "value": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('name'))]"
-                    },
-                    "ipAddress": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The public IP address of the public IP address resource."
-                      },
-                      "value": "[coalesce(tryGet(reference('publicIpAddress'), 'ipAddress'), '')]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('publicIpAddress', '2024-05-01', 'full').location]"
-                    }
-                  }
-                }
-              }
-            }
-          },
-          "outputs": {
-            "resourceGroupName": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource group the Azure Bastion was deployed into."
-              },
-              "value": "[resourceGroup().name]"
-            },
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "The name the Azure Bastion."
-              },
-              "value": "[parameters('name')]"
-            },
-            "resourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource ID the Azure Bastion."
-              },
-              "value": "[resourceId('Microsoft.Network/bastionHosts', parameters('name'))]"
-            },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "The location the resource was deployed into."
-              },
-              "value": "[reference('azureBastion', '2024-05-01', 'full').location]"
-            },
-            "ipConfAzureBastionSubnet": {
-              "type": "object",
-              "metadata": {
-                "description": "The Public IPconfiguration object for the AzureBastionSubnet."
-              },
-              "value": "[if(equals(parameters('skuName'), 'Developer'), createObject(), reference('azureBastion').ipConfigurations[0])]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "virtualNetwork"
-      ]
-    },
-    "virtualMachine": {
-      "condition": "[and(variables('virtualNetworkEnabled'), variables('virtualMachineEnabled'))]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2022-09-01",
-      "name": "[take(format('avm.res.compute.virtual-machine.{0}', variables('virtualMachineResourceName')), 64)]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[variables('virtualMachineResourceName')]"
-          },
-          "computerName": {
-            "value": "[take(variables('virtualMachineResourceName'), 15)]"
-          },
-          "location": {
-            "value": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'location'), parameters('solutionLocation'))]"
-          },
-          "tags": {
-            "value": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'tags'), parameters('tags'))]"
-          },
-          "enableTelemetry": {
-            "value": "[parameters('enableTelemetry')]"
-          },
-          "vmSize": {
-            "value": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'vmSize'), 'Standard_D2s_v3')]"
-          },
-          "adminUsername": {
-            "value": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'adminUsername'), 'adminuser')]"
-          },
-          "adminPassword": {
-            "value": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'adminPassword'), guid(parameters('solutionPrefix'), subscription().subscriptionId))]"
-          },
-          "nicConfigurations": {
-            "value": [
-              {
-                "name": "[format('nic-{0}', variables('virtualMachineResourceName'))]",
-                "diagnosticSettings": [
-                  {
-                    "workspaceResourceId": "[if(variables('useExistingWorkspace'), variables('existingWorkspaceResourceId'), listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId)]"
-                  }
-                ],
-                "ipConfigurations": [
-                  {
-                    "name": "[format('{0}-nic01-ipconfig01', variables('virtualMachineResourceName'))]",
-                    "subnetResourceId": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'subnetResourceId'), reference('virtualNetwork').outputs.subnetResourceIds.value[1])]",
-                    "diagnosticSettings": [
-                      {
-                        "workspaceResourceId": "[if(variables('useExistingWorkspace'), variables('existingWorkspaceResourceId'), listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId)]"
-                      }
-                    ]
-                  }
-                ]
-              }
-            ]
-          },
-          "imageReference": {
-            "value": {
-              "publisher": "microsoft-dsvm",
-              "offer": "dsvm-win-2022",
-              "sku": "winserver-2022",
-              "version": "latest"
-            }
-          },
-          "osDisk": {
-            "value": {
-              "name": "[format('osdisk-{0}', variables('virtualMachineResourceName'))]",
-              "createOption": "FromImage",
-              "managedDisk": {
-                "storageAccountType": "Premium_ZRS"
-              },
-              "diskSizeGB": 128,
-              "caching": "ReadWrite"
-            }
-          },
-          "osType": {
-            "value": "Windows"
-          },
-          "encryptionAtHost": {
-            "value": false
-          },
-          "zone": {
-            "value": 0
-          },
-          "extensionAadJoinConfig": {
-            "value": {
-              "enabled": true,
-              "typeHandlerVersion": "1.0"
-            }
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.34.44.8038",
-              "templateHash": "13105916093025105823"
-            },
-            "name": "Virtual Machines",
-            "description": "This module deploys a Virtual Machine with one or multiple NICs and optionally one or multiple public IPs."
-          },
-          "definitions": {
-            "osDiskType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The disk name."
-                  }
-                },
-                "diskSizeGB": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specifies the size of an empty data disk in gigabytes."
-                  }
-                },
-                "createOption": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Attach",
-                    "Empty",
-                    "FromImage"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specifies how the virtual machine should be created."
-                  }
-                },
-                "deleteOption": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Delete",
-                    "Detach"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specifies whether data disk should be deleted or detached upon VM deletion."
-                  }
-                },
-                "caching": {
-                  "type": "string",
-                  "allowedValues": [
-                    "None",
-                    "ReadOnly",
-                    "ReadWrite"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specifies the caching requirements."
-                  }
-                },
-                "diffDiskSettings": {
-                  "type": "object",
-                  "properties": {
-                    "placement": {
-                      "type": "string",
-                      "allowedValues": [
-                        "CacheDisk",
-                        "NvmeDisk",
-                        "ResourceDisk"
-                      ],
-                      "metadata": {
-                        "description": "Required. Specifies the ephemeral disk placement for the operating system disk."
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specifies the ephemeral Disk Settings for the operating system disk."
-                  }
-                },
-                "managedDisk": {
-                  "type": "object",
-                  "properties": {
-                    "storageAccountType": {
-                      "type": "string",
-                      "allowedValues": [
-                        "PremiumV2_LRS",
-                        "Premium_LRS",
-                        "Premium_ZRS",
-                        "StandardSSD_LRS",
-                        "StandardSSD_ZRS",
-                        "Standard_LRS",
-                        "UltraSSD_LRS"
-                      ],
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Specifies the storage account type for the managed disk."
-                      }
-                    },
-                    "diskEncryptionSetResourceId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Specifies the customer managed disk encryption set resource id for the managed disk."
-                      }
-                    }
-                  },
-                  "metadata": {
-                    "description": "Required. The managed disk parameters."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type describing an OS disk."
-              }
-            },
-            "dataDiskType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The disk name."
-                  }
-                },
-                "lun": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specifies the logical unit number of the data disk."
-                  }
-                },
-                "diskSizeGB": {
-                  "type": "int",
-                  "metadata": {
-                    "description": "Required. Specifies the size of an empty data disk in gigabytes."
-                  }
-                },
-                "createOption": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Attach",
-                    "Empty",
-                    "FromImage"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specifies how the virtual machine should be created."
-                  }
-                },
-                "deleteOption": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Delete",
-                    "Detach"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specifies whether data disk should be deleted or detached upon VM deletion."
-                  }
-                },
-                "caching": {
-                  "type": "string",
-                  "allowedValues": [
-                    "None",
-                    "ReadOnly",
-                    "ReadWrite"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specifies the caching requirements."
-                  }
-                },
-                "diskIOPSReadWrite": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The number of IOPS allowed for this disk; only settable for UltraSSD disks. One operation can transfer between 4k and 256k bytes."
-                  }
-                },
-                "diskMBpsReadWrite": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The bandwidth allowed for this disk; only settable for UltraSSD disks. MBps means millions of bytes per second - MB here uses the ISO notation, of powers of 10."
-                  }
-                },
-                "managedDisk": {
-                  "type": "object",
-                  "properties": {
-                    "storageAccountType": {
-                      "type": "string",
-                      "allowedValues": [
-                        "PremiumV2_LRS",
-                        "Premium_LRS",
-                        "Premium_ZRS",
-                        "StandardSSD_LRS",
-                        "StandardSSD_ZRS",
-                        "Standard_LRS",
-                        "UltraSSD_LRS"
-                      ],
-                      "metadata": {
-                        "description": "Required. Specifies the storage account type for the managed disk."
-                      }
-                    },
-                    "diskEncryptionSetResourceId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Specifies the customer managed disk encryption set resource id for the managed disk."
-                      }
-                    },
-                    "id": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Specifies the customer managed disk id for the managed disk."
-                      }
-                    }
-                  },
-                  "metadata": {
-                    "description": "Required. The managed disk parameters."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type describing a data disk."
-              }
-            },
-            "publicKeyType": {
-              "type": "object",
-              "properties": {
-                "keyData": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Specifies the SSH public key data used to authenticate through ssh."
-                  }
-                },
-                "path": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Specifies the full path on the created VM where ssh public key is stored. If the file already exists, the specified key is appended to the file."
-                  }
-                }
-              }
-            },
-            "lockType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of lock."
-                  }
-                },
-                "kind": {
-                  "type": "string",
-                  "allowedValues": [
-                    "CanNotDelete",
-                    "None",
-                    "ReadOnly"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a lock.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "managedIdentityAllType": {
-              "type": "object",
-              "properties": {
-                "systemAssigned": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Enables system assigned managed identity on the resource."
-                  }
-                },
-                "userAssignedResourceIds": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "roleAssignmentType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                  }
-                },
-                "roleDefinitionIdOrName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                  }
-                },
-                "principalId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                  }
-                },
-                "principalType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Device",
-                    "ForeignGroup",
-                    "Group",
-                    "ServicePrincipal",
-                    "User"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The principal type of the assigned principal ID."
-                  }
-                },
-                "description": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The description of the role assignment."
-                  }
-                },
-                "condition": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                  }
-                },
-                "conditionVersion": {
-                  "type": "string",
-                  "allowedValues": [
-                    "2.0"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Version of the condition."
-                  }
-                },
-                "delegatedManagedIdentityResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a role assignment.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. The name of the virtual machine to be created. You should use a unique prefix to reduce name collisions in Active Directory."
-              }
-            },
-            "computerName": {
-              "type": "string",
-              "defaultValue": "[parameters('name')]",
-              "metadata": {
-                "description": "Optional. Can be used if the computer name needs to be different from the Azure VM resource name. If not used, the resource name will be used as computer name."
-              }
-            },
-            "vmSize": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. Specifies the size for the VMs."
-              }
-            },
-            "encryptionAtHost": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. This property can be used by user in the request to enable or disable the Host Encryption for the virtual machine. This will enable the encryption for all the disks including Resource/Temp disk at host itself. For security reasons, it is recommended to set encryptionAtHost to True. Restrictions: Cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs."
-              }
-            },
-            "securityType": {
-              "type": "string",
-              "defaultValue": "",
-              "allowedValues": [
-                "",
-                "ConfidentialVM",
-                "TrustedLaunch"
-              ],
-              "metadata": {
-                "description": "Optional. Specifies the SecurityType of the virtual machine. It has to be set to any specified value to enable UefiSettings. The default behavior is: UefiSettings will not be enabled unless this property is set."
-              }
-            },
-            "secureBootEnabled": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Specifies whether secure boot should be enabled on the virtual machine. This parameter is part of the UefiSettings. SecurityType should be set to TrustedLaunch to enable UefiSettings."
-              }
-            },
-            "vTpmEnabled": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Specifies whether vTPM should be enabled on the virtual machine. This parameter is part of the UefiSettings.  SecurityType should be set to TrustedLaunch to enable UefiSettings."
-              }
-            },
-            "imageReference": {
-              "type": "object",
-              "metadata": {
-                "description": "Required. OS image reference. In case of marketplace images, it's the combination of the publisher, offer, sku, version attributes. In case of custom images it's the resource ID of the custom image."
-              }
-            },
-            "plan": {
-              "type": "object",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Optional. Specifies information about the marketplace image used to create the virtual machine. This element is only used for marketplace images. Before you can use a marketplace image from an API, you must enable the image for programmatic use."
-              }
-            },
-            "osDisk": {
-              "$ref": "#/definitions/osDiskType",
-              "metadata": {
-                "description": "Required. Specifies the OS disk. For security reasons, it is recommended to specify DiskEncryptionSet into the osDisk object.  Restrictions: DiskEncryptionSet cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs."
-              }
-            },
-            "dataDisks": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/dataDiskType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Specifies the data disks. For security reasons, it is recommended to specify DiskEncryptionSet into the dataDisk object. Restrictions: DiskEncryptionSet cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs."
-              }
-            },
-            "ultraSSDEnabled": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. The flag that enables or disables a capability to have one or more managed data disks with UltraSSD_LRS storage account type on the VM or VMSS. Managed disks with storage account type UltraSSD_LRS can be added to a virtual machine or virtual machine scale set only if this property is enabled."
-              }
-            },
-            "adminUsername": {
-              "type": "securestring",
-              "metadata": {
-                "description": "Required. Administrator username."
-              }
-            },
-            "adminPassword": {
-              "type": "securestring",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. When specifying a Windows Virtual Machine, this value should be passed."
-              }
-            },
-            "userData": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. UserData for the VM, which must be base-64 encoded. Customer should not pass any secrets in here."
-              }
-            },
-            "customData": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. Custom data associated to the VM, this value will be automatically converted into base64 to account for the expected VM format."
-              }
-            },
-            "certificatesToBeInstalled": {
-              "type": "array",
-              "defaultValue": [],
-              "metadata": {
-                "description": "Optional. Specifies set of certificates that should be installed onto the virtual machine."
-              }
-            },
-            "priority": {
-              "type": "string",
-              "defaultValue": "Regular",
-              "allowedValues": [
-                "Regular",
-                "Low",
-                "Spot"
-              ],
-              "metadata": {
-                "description": "Optional. Specifies the priority for the virtual machine."
-              }
-            },
-            "evictionPolicy": {
-              "type": "string",
-              "defaultValue": "Deallocate",
-              "allowedValues": [
-                "Deallocate",
-                "Delete"
-              ],
-              "metadata": {
-                "description": "Optional. Specifies the eviction policy for the low priority virtual machine."
-              }
-            },
-            "maxPriceForLowPriorityVm": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. Specifies the maximum price you are willing to pay for a low priority VM/VMSS. This price is in US Dollars."
-              }
-            },
-            "dedicatedHostId": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. Specifies resource ID about the dedicated host that the virtual machine resides in."
-              }
-            },
-            "licenseType": {
-              "type": "string",
-              "defaultValue": "",
-              "allowedValues": [
-                "RHEL_BYOS",
-                "SLES_BYOS",
-                "Windows_Client",
-                "Windows_Server",
-                ""
-              ],
-              "metadata": {
-                "description": "Optional. Specifies that the image or disk that is being used was licensed on-premises."
-              }
-            },
-            "publicKeys": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/publicKeyType"
-              },
-              "defaultValue": [],
-              "metadata": {
-                "description": "Optional. The list of SSH public keys used to authenticate with linux based VMs."
-              }
-            },
-            "managedIdentities": {
-              "$ref": "#/definitions/managedIdentityAllType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The managed identity definition for this resource. The system-assigned managed identity will automatically be enabled if extensionAadJoinConfig.enabled = \"True\"."
-              }
-            },
-            "bootDiagnostics": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Whether boot diagnostics should be enabled on the Virtual Machine. Boot diagnostics will be enabled with a managed storage account if no bootDiagnosticsStorageAccountName value is provided. If bootDiagnostics and bootDiagnosticsStorageAccountName values are not provided, boot diagnostics will be disabled."
-              }
-            },
-            "bootDiagnosticStorageAccountName": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. Custom storage account used to store boot diagnostic information. Boot diagnostics will be enabled with a custom storage account if a value is provided."
-              }
-            },
-            "bootDiagnosticStorageAccountUri": {
-              "type": "string",
-              "defaultValue": "[format('.blob.{0}/', environment().suffixes.storage)]",
-              "metadata": {
-                "description": "Optional. Storage account boot diagnostic base URI."
-              }
-            },
-            "proximityPlacementGroupResourceId": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. Resource ID of a proximity placement group."
-              }
-            },
-            "virtualMachineScaleSetResourceId": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. Resource ID of a virtual machine scale set, where the VM should be added."
-              }
-            },
-            "availabilitySetResourceId": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. Resource ID of an availability set. Cannot be used in combination with availability zone nor scale set."
-              }
-            },
-            "galleryApplications": {
-              "type": "array",
-              "defaultValue": [],
-              "metadata": {
-                "description": "Optional. Specifies the gallery applications that should be made available to the VM/VMSS."
-              }
-            },
-            "zone": {
-              "type": "int",
-              "allowedValues": [
-                0,
-                1,
-                2,
-                3
-              ],
-              "metadata": {
-                "description": "Required. If set to 1, 2 or 3, the availability zone for all VMs is hardcoded to that value. If zero, then availability zones is not used. Cannot be used in combination with availability set nor scale set."
-              }
-            },
-            "nicConfigurations": {
-              "type": "array",
-              "metadata": {
-                "description": "Required. Configures NICs and PIPs."
-              }
-            },
-            "backupVaultName": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. Recovery service vault name to add VMs to backup."
-              }
-            },
-            "backupVaultResourceGroup": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().name]",
-              "metadata": {
-                "description": "Optional. Resource group of the backup recovery service vault. If not provided the current resource group name is considered by default."
-              }
-            },
-            "backupPolicyName": {
-              "type": "string",
-              "defaultValue": "DefaultPolicy",
-              "metadata": {
-                "description": "Optional. Backup policy the VMs should be using for backup. If not provided, it will use the DefaultPolicy from the backup recovery service vault."
-              }
-            },
-            "autoShutdownConfig": {
-              "type": "object",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Optional. The configuration for auto-shutdown."
-              }
-            },
-            "maintenanceConfigurationResourceId": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. The resource Id of a maintenance configuration for this VM."
-              }
-            },
-            "allowExtensionOperations": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Specifies whether extension operations should be allowed on the virtual machine. This may only be set to False when no extensions are present on the virtual machine."
-              }
-            },
-            "extensionDomainJoinPassword": {
-              "type": "securestring",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. Required if name is specified. Password of the user specified in user parameter."
-              }
-            },
-            "extensionDomainJoinConfig": {
-              "type": "secureObject",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Optional. The configuration for the [Domain Join] extension. Must at least contain the [\"enabled\": true] property to be executed."
-              }
-            },
-            "extensionAadJoinConfig": {
-              "type": "object",
-              "defaultValue": {
-                "enabled": false
-              },
-              "metadata": {
-                "description": "Optional. The configuration for the [AAD Join] extension. Must at least contain the [\"enabled\": true] property to be executed. To enroll in Intune, add the setting mdmId: \"0000000a-0000-0000-c000-000000000000\"."
-              }
-            },
-            "extensionAntiMalwareConfig": {
-              "type": "object",
-              "defaultValue": "[if(equals(parameters('osType'), 'Windows'), createObject('enabled', true()), createObject('enabled', false()))]",
-              "metadata": {
-                "description": "Optional. The configuration for the [Anti Malware] extension. Must at least contain the [\"enabled\": true] property to be executed."
-              }
-            },
-            "extensionMonitoringAgentConfig": {
-              "type": "object",
-              "defaultValue": {
-                "enabled": false,
-                "dataCollectionRuleAssociations": []
-              },
-              "metadata": {
-                "description": "Optional. The configuration for the [Monitoring Agent] extension. Must at least contain the [\"enabled\": true] property to be executed."
-              }
-            },
-            "extensionDependencyAgentConfig": {
-              "type": "object",
-              "defaultValue": {
-                "enabled": false
-              },
-              "metadata": {
-                "description": "Optional. The configuration for the [Dependency Agent] extension. Must at least contain the [\"enabled\": true] property to be executed."
-              }
-            },
-            "extensionNetworkWatcherAgentConfig": {
-              "type": "object",
-              "defaultValue": {
-                "enabled": false
-              },
-              "metadata": {
-                "description": "Optional. The configuration for the [Network Watcher Agent] extension. Must at least contain the [\"enabled\": true] property to be executed."
-              }
-            },
-            "extensionAzureDiskEncryptionConfig": {
-              "type": "object",
-              "defaultValue": {
-                "enabled": false
-              },
-              "metadata": {
-                "description": "Optional. The configuration for the [Azure Disk Encryption] extension. Must at least contain the [\"enabled\": true] property to be executed. Restrictions: Cannot be enabled on disks that have encryption at host enabled. Managed disks encrypted using Azure Disk Encryption cannot be encrypted using customer-managed keys."
-              }
-            },
-            "extensionDSCConfig": {
-              "type": "object",
-              "defaultValue": {
-                "enabled": false
-              },
-              "metadata": {
-                "description": "Optional. The configuration for the [Desired State Configuration] extension. Must at least contain the [\"enabled\": true] property to be executed."
-              }
-            },
-            "extensionCustomScriptConfig": {
-              "type": "object",
-              "defaultValue": {
-                "enabled": false,
-                "fileData": []
-              },
-              "metadata": {
-                "description": "Optional. The configuration for the [Custom Script] extension. Must at least contain the [\"enabled\": true] property to be executed."
-              }
-            },
-            "extensionNvidiaGpuDriverWindows": {
-              "type": "object",
-              "defaultValue": {
-                "enabled": false
-              },
-              "metadata": {
-                "description": "Optional. The configuration for the [Nvidia Gpu Driver Windows] extension. Must at least contain the [\"enabled\": true] property to be executed."
-              }
-            },
-            "extensionHostPoolRegistration": {
-              "type": "object",
-              "defaultValue": {
-                "enabled": false
-              },
-              "metadata": {
-                "description": "Optional. The configuration for the [Host Pool Registration] extension. Must at least contain the [\"enabled\": true] property to be executed. Needs a managed identy."
-              }
-            },
-            "extensionGuestConfigurationExtension": {
-              "type": "object",
-              "defaultValue": {
-                "enabled": false
-              },
-              "metadata": {
-                "description": "Optional. The configuration for the [Guest Configuration] extension. Must at least contain the [\"enabled\": true] property to be executed. Needs a managed identy."
-              }
-            },
-            "guestConfiguration": {
-              "type": "object",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Optional. The guest configuration for the virtual machine. Needs the Guest Configuration extension to be enabled."
-              }
-            },
-            "extensionCustomScriptProtectedSetting": {
-              "type": "secureObject",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Optional. An object that contains the extension specific protected settings."
-              }
-            },
-            "extensionGuestConfigurationExtensionProtectedSettings": {
-              "type": "secureObject",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Optional. An object that contains the extension specific protected settings."
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional. Location for all resources."
-              }
-            },
-            "lock": {
-              "$ref": "#/definitions/lockType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The lock settings of the service."
-              }
-            },
-            "roleAssignments": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/roleAssignmentType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of role assignments to create."
-              }
-            },
-            "tags": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Tags of the resource."
-              }
-            },
-            "enableTelemetry": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Enable/Disable usage telemetry for module."
-              }
-            },
-            "baseTime": {
-              "type": "string",
-              "defaultValue": "[utcNow('u')]",
-              "metadata": {
-                "description": "Generated. Do not provide a value! This date value is used to generate a registration token."
-              }
-            },
-            "sasTokenValidityLength": {
-              "type": "string",
-              "defaultValue": "PT8H",
-              "metadata": {
-                "description": "Optional. SAS token validity length to use to download files from storage accounts. Usage: 'PT8H' - valid for 8 hours; 'P5D' - valid for 5 days; 'P1Y' - valid for 1 year. When not provided, the SAS token will be valid for 8 hours."
-              }
-            },
-            "osType": {
-              "type": "string",
-              "allowedValues": [
-                "Windows",
-                "Linux"
-              ],
-              "metadata": {
-                "description": "Required. The chosen OS type."
-              }
-            },
-            "disablePasswordAuthentication": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Specifies whether password authentication should be disabled."
-              }
-            },
-            "provisionVMAgent": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Indicates whether virtual machine agent should be provisioned on the virtual machine. When this property is not specified in the request body, default behavior is to set it to true. This will ensure that VM Agent is installed on the VM so that extensions can be added to the VM later."
-              }
-            },
-            "enableAutomaticUpdates": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Indicates whether Automatic Updates is enabled for the Windows virtual machine. Default value is true. When patchMode is set to Manual, this parameter must be set to false. For virtual machine scale sets, this property can be updated and updates will take effect on OS reprovisioning."
-              }
-            },
-            "patchMode": {
-              "type": "string",
-              "defaultValue": "",
-              "allowedValues": [
-                "AutomaticByPlatform",
-                "AutomaticByOS",
-                "Manual",
-                "ImageDefault",
-                ""
-              ],
-              "metadata": {
-                "description": "Optional. VM guest patching orchestration mode. 'AutomaticByOS' & 'Manual' are for Windows only, 'ImageDefault' for Linux only. Refer to 'https://learn.microsoft.com/en-us/azure/virtual-machines/automatic-vm-guest-patching'."
-              }
-            },
-            "bypassPlatformSafetyChecksOnUserSchedule": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Enables customer to schedule patching without accidental upgrades."
-              }
-            },
-            "rebootSetting": {
-              "type": "string",
-              "defaultValue": "IfRequired",
-              "allowedValues": [
-                "Always",
-                "IfRequired",
-                "Never",
-                "Unknown"
-              ],
-              "metadata": {
-                "description": "Optional. Specifies the reboot setting for all AutomaticByPlatform patch installation operations."
-              }
-            },
-            "patchAssessmentMode": {
-              "type": "string",
-              "defaultValue": "ImageDefault",
-              "allowedValues": [
-                "AutomaticByPlatform",
-                "ImageDefault"
-              ],
-              "metadata": {
-                "description": "Optional. VM guest patching assessment mode. Set it to 'AutomaticByPlatform' to enable automatically check for updates every 24 hours."
-              }
-            },
-            "enableHotpatching": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Enables customers to patch their Azure VMs without requiring a reboot. For enableHotpatching, the 'provisionVMAgent' must be set to true and 'patchMode' must be set to 'AutomaticByPlatform'."
-              }
-            },
-            "timeZone": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. Specifies the time zone of the virtual machine. e.g. 'Pacific Standard Time'. Possible values can be `TimeZoneInfo.id` value from time zones returned by `TimeZoneInfo.GetSystemTimeZones`."
-              }
-            },
-            "additionalUnattendContent": {
-              "type": "array",
-              "defaultValue": [],
-              "metadata": {
-                "description": "Optional. Specifies additional XML formatted information that can be included in the Unattend.xml file, which is used by Windows Setup. Contents are defined by setting name, component name, and the pass in which the content is applied."
-              }
-            },
-            "winRM": {
-              "type": "array",
-              "defaultValue": [],
-              "metadata": {
-                "description": "Optional. Specifies the Windows Remote Management listeners. This enables remote Windows PowerShell. - WinRMConfiguration object."
-              }
-            },
-            "configurationProfile": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. The configuration profile of automanage. Either '/providers/Microsoft.Automanage/bestPractices/AzureBestPracticesProduction', 'providers/Microsoft.Automanage/bestPractices/AzureBestPracticesDevTest' or the resource Id of custom profile."
-              }
-            }
-          },
-          "variables": {
-            "copy": [
-              {
-                "name": "publicKeysFormatted",
-                "count": "[length(parameters('publicKeys'))]",
-                "input": {
-                  "path": "[parameters('publicKeys')[copyIndex('publicKeysFormatted')].path]",
-                  "keyData": "[parameters('publicKeys')[copyIndex('publicKeysFormatted')].keyData]"
-                }
-              },
-              {
-                "name": "formattedRoleAssignments",
-                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-              }
-            ],
-            "enableReferencedModulesTelemetry": false,
-            "linuxConfiguration": {
-              "disablePasswordAuthentication": "[parameters('disablePasswordAuthentication')]",
-              "ssh": {
-                "publicKeys": "[variables('publicKeysFormatted')]"
-              },
-              "provisionVMAgent": "[parameters('provisionVMAgent')]",
-              "patchSettings": "[if(and(parameters('provisionVMAgent'), or(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), equals(toLower(parameters('patchMode')), toLower('ImageDefault')))), createObject('patchMode', parameters('patchMode'), 'assessmentMode', parameters('patchAssessmentMode'), 'automaticByPlatformSettings', if(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), createObject('bypassPlatformSafetyChecksOnUserSchedule', parameters('bypassPlatformSafetyChecksOnUserSchedule'), 'rebootSetting', parameters('rebootSetting')), null())), null())]"
-            },
-            "windowsConfiguration": {
-              "provisionVMAgent": "[parameters('provisionVMAgent')]",
-              "enableAutomaticUpdates": "[parameters('enableAutomaticUpdates')]",
-              "patchSettings": "[if(and(parameters('provisionVMAgent'), or(or(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), equals(toLower(parameters('patchMode')), toLower('AutomaticByOS'))), equals(toLower(parameters('patchMode')), toLower('Manual')))), createObject('patchMode', parameters('patchMode'), 'assessmentMode', parameters('patchAssessmentMode'), 'enableHotpatching', if(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), parameters('enableHotpatching'), false()), 'automaticByPlatformSettings', if(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), createObject('bypassPlatformSafetyChecksOnUserSchedule', parameters('bypassPlatformSafetyChecksOnUserSchedule'), 'rebootSetting', parameters('rebootSetting')), null())), null())]",
-              "timeZone": "[if(empty(parameters('timeZone')), null(), parameters('timeZone'))]",
-              "additionalUnattendContent": "[if(empty(parameters('additionalUnattendContent')), null(), parameters('additionalUnattendContent'))]",
-              "winRM": "[if(not(empty(parameters('winRM'))), createObject('listeners', parameters('winRM')), null())]"
-            },
-            "accountSasProperties": {
-              "signedServices": "b",
-              "signedPermission": "r",
-              "signedExpiry": "[dateTimeAdd(parameters('baseTime'), parameters('sasTokenValidityLength'))]",
-              "signedResourceTypes": "o",
-              "signedProtocol": "https"
-            },
-            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(if(parameters('extensionAadJoinConfig').enabled, true(), coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false())), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
-            "builtInRoleNames": {
-              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-              "Data Operator for Managed Disks": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '959f8984-c045-4866-89c7-12bf9737be2e')]",
-              "Desktop Virtualization Power On Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '489581de-a3bd-480d-9518-53dea7416b33')]",
-              "Desktop Virtualization Power On Off Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '40c5ff49-9181-41f8-ae61-143b0e78555e')]",
-              "Desktop Virtualization Virtual Machine Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a959dbd1-f747-45e3-8ba6-dd80f235f97c')]",
-              "DevTest Labs User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76283e04-6283-4c54-8f91-bcf1374a3c64')]",
-              "Disk Backup Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3e5e47e6-65f7-47ef-90b5-e5dd4d455f24')]",
-              "Disk Pool Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '60fc6e62-5479-42d4-8bf4-67625fcc2840')]",
-              "Disk Restore Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b50d9833-a0cb-478e-945f-707fcc997c13')]",
-              "Disk Snapshot Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7efff54f-a5b4-42b5-a1c5-5411624893ce')]",
-              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
-              "Virtual Machine Administrator Login": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '1c0163c0-47e6-4577-8991-ea5c82e286e4')]",
-              "Virtual Machine Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9980e02c-c2be-4d73-94e8-173b1dc7cf3c')]",
-              "Virtual Machine User Login": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fb879df8-f326-4884-b1cf-06f3ad86be52')]",
-              "VM Scanner Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'd24ecba3-c1f4-40fa-a7bb-4588a071e8fd')]"
-            }
-          },
-          "resources": {
-            "avmTelemetry": {
-              "condition": "[parameters('enableTelemetry')]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.compute-virtualmachine.{0}.{1}', replace('0.13.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-              "properties": {
-                "mode": "Incremental",
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "resources": [],
-                  "outputs": {
-                    "telemetry": {
-                      "type": "String",
-                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                    }
-                  }
-                }
-              }
-            },
-            "managedDataDisks": {
-              "copy": {
-                "name": "managedDataDisks",
-                "count": "[length(coalesce(parameters('dataDisks'), createArray()))]"
-              },
-              "type": "Microsoft.Compute/disks",
-              "apiVersion": "2024-03-02",
-              "name": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()], 'name'), format('{0}-disk-data-{1}', parameters('name'), padLeft(add(copyIndex(), 1), 2, '0')))]",
-              "location": "[parameters('location')]",
-              "sku": {
-                "name": "[coalesce(parameters('dataDisks'), createArray())[copyIndex()].managedDisk.storageAccountType]"
-              },
-              "properties": {
-                "diskSizeGB": "[coalesce(parameters('dataDisks'), createArray())[copyIndex()].diskSizeGB]",
-                "creationData": {
-                  "createOption": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()], 'createoption'), 'Empty')]"
-                },
-                "diskIOPSReadWrite": "[tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()], 'diskIOPSReadWrite')]",
-                "diskMBpsReadWrite": "[tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()], 'diskMBpsReadWrite')]"
-              },
-              "zones": "[if(and(not(equals(parameters('zone'), 0)), not(contains(coalesce(parameters('dataDisks'), createArray())[copyIndex()].managedDisk.storageAccountType, 'ZRS'))), array(string(parameters('zone'))), null())]"
-            },
-            "vm": {
-              "type": "Microsoft.Compute/virtualMachines",
-              "apiVersion": "2024-07-01",
-              "name": "[parameters('name')]",
-              "location": "[parameters('location')]",
-              "identity": "[variables('identity')]",
-              "tags": "[parameters('tags')]",
-              "zones": "[if(not(equals(parameters('zone'), 0)), array(string(parameters('zone'))), null())]",
-              "plan": "[if(not(empty(parameters('plan'))), parameters('plan'), null())]",
-              "properties": {
-                "hardwareProfile": {
-                  "vmSize": "[parameters('vmSize')]"
-                },
-                "securityProfile": {
-                  "encryptionAtHost": "[if(parameters('encryptionAtHost'), parameters('encryptionAtHost'), null())]",
-                  "securityType": "[parameters('securityType')]",
-                  "uefiSettings": "[if(equals(parameters('securityType'), 'TrustedLaunch'), createObject('secureBootEnabled', parameters('secureBootEnabled'), 'vTpmEnabled', parameters('vTpmEnabled')), null())]"
-                },
-                "storageProfile": {
-                  "copy": [
-                    {
-                      "name": "dataDisks",
-                      "count": "[length(coalesce(parameters('dataDisks'), createArray()))]",
-                      "input": {
-                        "lun": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'lun'), copyIndex('dataDisks'))]",
-                        "name": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'name'), format('{0}-disk-data-{1}', parameters('name'), padLeft(add(copyIndex('dataDisks'), 1), 2, '0')))]",
-                        "diskSizeGB": "[coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].diskSizeGB]",
-                        "createOption": "[if(not(equals(resourceId('Microsoft.Compute/disks', coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'name'), format('{0}-disk-data-{1}', parameters('name'), padLeft(add(copyIndex('dataDisks'), 1), 2, '0')))), null())), 'Attach', coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'createoption'), 'Empty'))]",
-                        "deleteOption": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'deleteOption'), 'Delete')]",
-                        "caching": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'caching'), 'ReadOnly')]",
-                        "managedDisk": {
-                          "storageAccountType": "[coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk.storageAccountType]",
-                          "id": "[resourceId('Microsoft.Compute/disks', coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'name'), format('{0}-disk-data-{1}', parameters('name'), padLeft(add(copyIndex('dataDisks'), 1), 2, '0'))))]",
-                          "diskEncryptionSet": {
-                            "id": "[tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'diskEncryptionSetResourceId')]"
-                          }
-                        }
-                      }
-                    }
-                  ],
-                  "imageReference": "[parameters('imageReference')]",
-                  "osDisk": {
-                    "name": "[coalesce(tryGet(parameters('osDisk'), 'name'), format('{0}-disk-os-01', parameters('name')))]",
-                    "createOption": "[coalesce(tryGet(parameters('osDisk'), 'createOption'), 'FromImage')]",
-                    "deleteOption": "[coalesce(tryGet(parameters('osDisk'), 'deleteOption'), 'Delete')]",
-                    "diffDiskSettings": "[if(empty(coalesce(tryGet(parameters('osDisk'), 'diffDiskSettings'), createObject())), null(), createObject('option', 'Local', 'placement', parameters('osDisk').diffDiskSettings.placement))]",
-                    "diskSizeGB": "[parameters('osDisk').diskSizeGB]",
-                    "caching": "[coalesce(tryGet(parameters('osDisk'), 'caching'), 'ReadOnly')]",
-                    "managedDisk": {
-                      "storageAccountType": "[parameters('osDisk').managedDisk.storageAccountType]",
-                      "diskEncryptionSet": {
-                        "id": "[tryGet(parameters('osDisk').managedDisk, 'diskEncryptionSetResourceId')]"
-                      }
-                    }
-                  }
-                },
-                "additionalCapabilities": {
-                  "ultraSSDEnabled": "[parameters('ultraSSDEnabled')]"
-                },
-                "osProfile": {
-                  "computerName": "[parameters('computerName')]",
-                  "adminUsername": "[parameters('adminUsername')]",
-                  "adminPassword": "[parameters('adminPassword')]",
-                  "customData": "[if(not(empty(parameters('customData'))), base64(parameters('customData')), null())]",
-                  "windowsConfiguration": "[if(equals(parameters('osType'), 'Windows'), variables('windowsConfiguration'), null())]",
-                  "linuxConfiguration": "[if(equals(parameters('osType'), 'Linux'), variables('linuxConfiguration'), null())]",
-                  "secrets": "[parameters('certificatesToBeInstalled')]",
-                  "allowExtensionOperations": "[parameters('allowExtensionOperations')]"
-                },
-                "networkProfile": {
-                  "copy": [
-                    {
-                      "name": "networkInterfaces",
-                      "count": "[length(parameters('nicConfigurations'))]",
-                      "input": {
-                        "properties": {
-                          "deleteOption": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex('networkInterfaces')], 'deleteOption'), 'Delete')]",
-                          "primary": "[if(equals(copyIndex('networkInterfaces'), 0), true(), false())]"
-                        },
-                        "id": "[resourceId('Microsoft.Network/networkInterfaces', coalesce(tryGet(parameters('nicConfigurations')[copyIndex('networkInterfaces')], 'name'), format('{0}{1}', parameters('name'), tryGet(parameters('nicConfigurations')[copyIndex('networkInterfaces')], 'nicSuffix'))))]"
-                      }
-                    }
-                  ]
-                },
-                "diagnosticsProfile": {
-                  "bootDiagnostics": {
-                    "enabled": "[if(not(empty(parameters('bootDiagnosticStorageAccountName'))), true(), parameters('bootDiagnostics'))]",
-                    "storageUri": "[if(not(empty(parameters('bootDiagnosticStorageAccountName'))), format('https://{0}{1}', parameters('bootDiagnosticStorageAccountName'), parameters('bootDiagnosticStorageAccountUri')), null())]"
-                  }
-                },
-                "applicationProfile": "[if(not(empty(parameters('galleryApplications'))), createObject('galleryApplications', parameters('galleryApplications')), null())]",
-                "availabilitySet": "[if(not(empty(parameters('availabilitySetResourceId'))), createObject('id', parameters('availabilitySetResourceId')), null())]",
-                "proximityPlacementGroup": "[if(not(empty(parameters('proximityPlacementGroupResourceId'))), createObject('id', parameters('proximityPlacementGroupResourceId')), null())]",
-                "virtualMachineScaleSet": "[if(not(empty(parameters('virtualMachineScaleSetResourceId'))), createObject('id', parameters('virtualMachineScaleSetResourceId')), null())]",
-                "priority": "[parameters('priority')]",
-                "evictionPolicy": "[if(not(equals('Regular', parameters('priority'))), parameters('evictionPolicy'), null())]",
-                "billingProfile": "[if(and(not(empty(parameters('priority'))), not(empty(parameters('maxPriceForLowPriorityVm')))), createObject('maxPrice', json(parameters('maxPriceForLowPriorityVm'))), null())]",
-                "host": "[if(not(empty(parameters('dedicatedHostId'))), createObject('id', parameters('dedicatedHostId')), null())]",
-                "licenseType": "[if(not(empty(parameters('licenseType'))), parameters('licenseType'), null())]",
-                "userData": "[if(not(empty(parameters('userData'))), base64(parameters('userData')), null())]"
-              },
-              "dependsOn": [
-                "managedDataDisks",
-                "vm_nic"
-              ]
-            },
-            "vm_configurationAssignment": {
-              "condition": "[not(empty(parameters('maintenanceConfigurationResourceId')))]",
-              "type": "Microsoft.Maintenance/configurationAssignments",
-              "apiVersion": "2023-04-01",
-              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
-              "name": "[format('{0}assignment', parameters('name'))]",
-              "location": "[parameters('location')]",
-              "properties": {
-                "maintenanceConfigurationId": "[parameters('maintenanceConfigurationResourceId')]",
-                "resourceId": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
-              },
-              "dependsOn": [
-                "vm"
-              ]
-            },
-            "vm_configurationProfileAssignment": {
-              "condition": "[not(empty(parameters('configurationProfile')))]",
-              "type": "Microsoft.Automanage/configurationProfileAssignments",
-              "apiVersion": "2022-05-04",
-              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
-              "name": "default",
-              "properties": {
-                "configurationProfile": "[parameters('configurationProfile')]"
-              },
-              "dependsOn": [
-                "vm"
-              ]
-            },
-            "vm_autoShutdownConfiguration": {
-              "condition": "[not(empty(parameters('autoShutdownConfig')))]",
-              "type": "Microsoft.DevTestLab/schedules",
-              "apiVersion": "2018-09-15",
-              "name": "[format('shutdown-computevm-{0}', parameters('name'))]",
-              "location": "[parameters('location')]",
-              "properties": {
-                "status": "[coalesce(tryGet(parameters('autoShutdownConfig'), 'status'), 'Disabled')]",
-                "targetResourceId": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]",
-                "taskType": "ComputeVmShutdownTask",
-                "dailyRecurrence": {
-                  "time": "[coalesce(tryGet(parameters('autoShutdownConfig'), 'dailyRecurrenceTime'), '19:00')]"
-                },
-                "timeZoneId": "[coalesce(tryGet(parameters('autoShutdownConfig'), 'timeZone'), 'UTC')]",
-                "notificationSettings": "[if(contains(parameters('autoShutdownConfig'), 'notificationStatus'), createObject('status', coalesce(tryGet(parameters('autoShutdownConfig'), 'notificationStatus'), 'Disabled'), 'emailRecipient', coalesce(tryGet(parameters('autoShutdownConfig'), 'notificationEmail'), ''), 'notificationLocale', coalesce(tryGet(parameters('autoShutdownConfig'), 'notificationLocale'), 'en'), 'webhookUrl', coalesce(tryGet(parameters('autoShutdownConfig'), 'notificationWebhookUrl'), ''), 'timeInMinutes', coalesce(tryGet(parameters('autoShutdownConfig'), 'notificationTimeInMinutes'), 30)), null())]"
-              },
-              "dependsOn": [
-                "vm"
-              ]
-            },
-            "vm_dataCollectionRuleAssociations": {
-              "copy": {
-                "name": "vm_dataCollectionRuleAssociations",
-                "count": "[length(parameters('extensionMonitoringAgentConfig').dataCollectionRuleAssociations)]"
-              },
-              "condition": "[parameters('extensionMonitoringAgentConfig').enabled]",
-              "type": "Microsoft.Insights/dataCollectionRuleAssociations",
-              "apiVersion": "2023-03-11",
-              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
-              "name": "[parameters('extensionMonitoringAgentConfig').dataCollectionRuleAssociations[copyIndex()].name]",
-              "properties": {
-                "dataCollectionRuleId": "[parameters('extensionMonitoringAgentConfig').dataCollectionRuleAssociations[copyIndex()].dataCollectionRuleResourceId]"
-              },
-              "dependsOn": [
-                "vm",
-                "vm_azureMonitorAgentExtension"
-              ]
-            },
-            "AzureWindowsBaseline": {
-              "condition": "[not(empty(parameters('guestConfiguration')))]",
-              "type": "Microsoft.GuestConfiguration/guestConfigurationAssignments",
-              "apiVersion": "2020-06-25",
-              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
-              "name": "AzureWindowsBaseline",
-              "location": "[parameters('location')]",
-              "properties": {
-                "guestConfiguration": "[parameters('guestConfiguration')]"
-              },
-              "dependsOn": [
-                "vm",
-                "vm_azureGuestConfigurationExtension"
-              ]
-            },
-            "vm_lock": {
-              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-              "type": "Microsoft.Authorization/locks",
-              "apiVersion": "2020-05-01",
-              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-              "properties": {
-                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-              },
-              "dependsOn": [
-                "vm"
-              ]
-            },
-            "vm_roleAssignments": {
-              "copy": {
-                "name": "vm_roleAssignments",
-                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-              },
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Compute/virtualMachines', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-              "properties": {
-                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-              },
-              "dependsOn": [
-                "vm"
-              ]
-            },
-            "vm_nic": {
-              "copy": {
-                "name": "vm_nic",
-                "count": "[length(parameters('nicConfigurations'))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-VM-Nic-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "networkInterfaceName": {
-                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'name'), format('{0}{1}', parameters('name'), tryGet(parameters('nicConfigurations')[copyIndex()], 'nicSuffix')))]"
-                  },
-                  "virtualMachineName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "enableIPForwarding": {
-                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'enableIPForwarding'), false())]"
-                  },
-                  "enableAcceleratedNetworking": {
-                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'enableAcceleratedNetworking'), true())]"
-                  },
-                  "dnsServers": "[if(contains(parameters('nicConfigurations')[copyIndex()], 'dnsServers'), if(not(empty(parameters('nicConfigurations')[copyIndex()].dnsServers)), createObject('value', parameters('nicConfigurations')[copyIndex()].dnsServers), createObject('value', createArray())), createObject('value', createArray()))]",
-                  "networkSecurityGroupResourceId": {
-                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'networkSecurityGroupResourceId'), '')]"
-                  },
-                  "ipConfigurations": {
-                    "value": "[parameters('nicConfigurations')[copyIndex()].ipConfigurations]"
-                  },
-                  "lock": {
-                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'lock'), parameters('lock'))]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'tags'), parameters('tags'))]"
-                  },
-                  "diagnosticSettings": {
-                    "value": "[tryGet(parameters('nicConfigurations')[copyIndex()], 'diagnosticSettings')]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(parameters('nicConfigurations')[copyIndex()], 'roleAssignments')]"
-                  },
-                  "enableTelemetry": {
-                    "value": "[variables('enableReferencedModulesTelemetry')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "8556043111080362230"
-                    }
-                  },
-                  "definitions": {
-                    "diagnosticSettingFullType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the diagnostic setting."
-                          }
-                        },
-                        "logCategoriesAndGroups": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                }
-                              },
-                              "categoryGroup": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                }
-                              },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                          }
-                        },
-                        "metricCategories": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                }
-                              },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                          }
-                        },
-                        "logAnalyticsDestinationType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "AzureDiagnostics",
-                            "Dedicated"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                          }
-                        },
-                        "workspaceResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "storageAccountResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "eventHubAuthorizationRuleResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                          }
-                        },
-                        "eventHubName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "marketplacePartnerResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "networkInterfaceName": {
-                      "type": "string"
-                    },
-                    "virtualMachineName": {
-                      "type": "string"
-                    },
-                    "ipConfigurations": {
-                      "type": "array"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Optional. Location for all resources."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the resource."
-                      }
-                    },
-                    "enableIPForwarding": {
-                      "type": "bool",
-                      "defaultValue": false
-                    },
-                    "enableAcceleratedNetworking": {
-                      "type": "bool",
-                      "defaultValue": false
-                    },
-                    "dnsServers": {
-                      "type": "array",
-                      "defaultValue": []
-                    },
-                    "enableTelemetry": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Enable telemetry via a Globally Unique Identifier (GUID)."
-                      }
-                    },
-                    "networkSecurityGroupResourceId": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. The network security group (NSG) to attach to the network interface."
-                      }
-                    },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The lock settings of the service."
-                      }
-                    },
-                    "diagnosticSettings": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/diagnosticSettingFullType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The diagnostic settings of the service."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "networkInterface_publicIPAddresses": {
-                      "copy": {
-                        "name": "networkInterface_publicIPAddresses",
-                        "count": "[length(parameters('ipConfigurations'))]"
-                      },
-                      "condition": "[and(contains(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), not(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'publicIPAddressResourceId')))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-publicIP-{1}', deployment().name, copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'name'), format('{0}{1}', parameters('virtualMachineName'), tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'publicIpNameSuffix')))]"
-                          },
-                          "diagnosticSettings": {
-                            "value": "[tryGet(parameters('ipConfigurations')[copyIndex()], 'diagnosticSettings')]"
-                          },
-                          "location": {
-                            "value": "[parameters('location')]"
-                          },
-                          "lock": {
-                            "value": "[parameters('lock')]"
-                          },
-                          "idleTimeoutInMinutes": {
-                            "value": "[tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'idleTimeoutInMinutes')]"
-                          },
-                          "ddosSettings": {
-                            "value": "[tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'ddosSettings')]"
-                          },
-                          "dnsSettings": {
-                            "value": "[tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'dnsSettings')]"
-                          },
-                          "publicIPAddressVersion": {
-                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'publicIPAddressVersion'), 'IPv4')]"
-                          },
-                          "publicIPAllocationMethod": {
-                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'publicIPAllocationMethod'), 'Static')]"
-                          },
-                          "publicIpPrefixResourceId": {
-                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'publicIPPrefixResourceId'), '')]"
-                          },
-                          "roleAssignments": {
-                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'roleAssignments'), createArray())]"
-                          },
-                          "skuName": {
-                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'skuName'), 'Standard')]"
-                          },
-                          "skuTier": {
-                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'skuTier'), 'Regional')]"
-                          },
-                          "tags": {
-                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()], 'tags'), parameters('tags'))]"
-                          },
-                          "zones": {
-                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'zones'), createArray(1, 2, 3))]"
-                          },
-                          "enableTelemetry": {
-                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()], 'enableTelemetry'), parameters('enableTelemetry'))]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.29.47.4906",
-                              "templateHash": "16693645977675862540"
-                            },
-                            "name": "Public IP Addresses",
-                            "description": "This module deploys a Public IP Address.",
-                            "owner": "Azure/module-maintainers"
-                          },
-                          "definitions": {
-                            "roleAssignmentType": {
-                              "type": "array",
-                              "items": {
-                                "type": "object",
-                                "properties": {
-                                  "name": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                    }
-                                  },
-                                  "roleDefinitionIdOrName": {
-                                    "type": "string",
-                                    "metadata": {
-                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                    }
-                                  },
-                                  "principalId": {
-                                    "type": "string",
-                                    "metadata": {
-                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                    }
-                                  },
-                                  "principalType": {
-                                    "type": "string",
-                                    "allowedValues": [
-                                      "Device",
-                                      "ForeignGroup",
-                                      "Group",
-                                      "ServicePrincipal",
-                                      "User"
-                                    ],
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The principal type of the assigned principal ID."
-                                    }
-                                  },
-                                  "description": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The description of the role assignment."
-                                    }
-                                  },
-                                  "condition": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                    }
-                                  },
-                                  "conditionVersion": {
-                                    "type": "string",
-                                    "allowedValues": [
-                                      "2.0"
-                                    ],
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. Version of the condition."
-                                    }
-                                  },
-                                  "delegatedManagedIdentityResourceId": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                    }
-                                  }
-                                }
-                              },
-                              "nullable": true
-                            },
-                            "lockType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the name of lock."
-                                  }
-                                },
-                                "kind": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "CanNotDelete",
-                                    "None",
-                                    "ReadOnly"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the type of lock."
-                                  }
-                                }
-                              },
-                              "nullable": true
-                            },
-                            "dnsSettingsType": {
-                              "type": "object",
-                              "properties": {
-                                "domainNameLabel": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The domain name label. The concatenation of the domain name label and the regionalized DNS zone make up the fully qualified domain name associated with the public IP address. If a domain name label is specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system."
-                                  }
-                                },
-                                "domainNameLabelScope": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "",
-                                    "NoReuse",
-                                    "ResourceGroupReuse",
-                                    "SubscriptionReuse",
-                                    "TenantReuse"
-                                  ],
-                                  "metadata": {
-                                    "description": "Required. The domain name label scope. If a domain name label and a domain name label scope are specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system with a hashed value includes in FQDN."
-                                  }
-                                },
-                                "fqdn": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The Fully Qualified Domain Name of the A DNS record associated with the public IP. This is the concatenation of the domainNameLabel and the regionalized DNS zone."
-                                  }
-                                },
-                                "reverseFqdn": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The reverse FQDN. A user-visible, fully qualified domain name that resolves to this public IP address. If the reverseFqdn is specified, then a PTR DNS record is created pointing from the IP address in the in-addr.arpa domain to the reverse FQDN."
-                                  }
-                                }
-                              }
-                            },
-                            "ddosSettingsType": {
-                              "type": "object",
-                              "properties": {
-                                "ddosProtectionPlan": {
-                                  "type": "object",
-                                  "properties": {
-                                    "id": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The resource ID of the DDOS protection plan associated with the public IP address."
-                                      }
-                                    }
-                                  },
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The DDoS protection plan associated with the public IP address."
-                                  }
-                                },
-                                "protectionMode": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "Enabled"
-                                  ],
-                                  "metadata": {
-                                    "description": "Required. The DDoS protection policy customizations."
-                                  }
-                                }
-                              }
-                            },
-                            "diagnosticSettingType": {
-                              "type": "array",
-                              "items": {
-                                "type": "object",
-                                "properties": {
-                                  "name": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The name of diagnostic setting."
-                                    }
-                                  },
-                                  "logCategoriesAndGroups": {
-                                    "type": "array",
-                                    "items": {
-                                      "type": "object",
-                                      "properties": {
-                                        "category": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                          }
-                                        },
-                                        "categoryGroup": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                          }
-                                        },
-                                        "enabled": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                          }
-                                        }
-                                      }
-                                    },
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                                    }
-                                  },
-                                  "metricCategories": {
-                                    "type": "array",
-                                    "items": {
-                                      "type": "object",
-                                      "properties": {
-                                        "category": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                          }
-                                        },
-                                        "enabled": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                          }
-                                        }
-                                      }
-                                    },
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                                    }
-                                  },
-                                  "logAnalyticsDestinationType": {
-                                    "type": "string",
-                                    "allowedValues": [
-                                      "AzureDiagnostics",
-                                      "Dedicated"
-                                    ],
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                                    }
-                                  },
-                                  "workspaceResourceId": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                    }
-                                  },
-                                  "storageAccountResourceId": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                    }
-                                  },
-                                  "eventHubAuthorizationRuleResourceId": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                                    }
-                                  },
-                                  "eventHubName": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                    }
-                                  },
-                                  "marketplacePartnerResourceId": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                                    }
-                                  }
-                                }
-                              },
-                              "nullable": true
-                            }
-                          },
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The name of the Public IP Address."
-                              }
-                            },
-                            "publicIpPrefixResourceId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Resource ID of the Public IP Prefix object. This is only needed if you want your Public IPs created in a PIP Prefix."
-                              }
-                            },
-                            "publicIPAllocationMethod": {
-                              "type": "string",
-                              "defaultValue": "Static",
-                              "allowedValues": [
-                                "Dynamic",
-                                "Static"
-                              ],
-                              "metadata": {
-                                "description": "Optional. The public IP address allocation method."
-                              }
-                            },
-                            "zones": {
-                              "type": "array",
-                              "items": {
-                                "type": "int"
-                              },
-                              "defaultValue": [
-                                1,
-                                2,
-                                3
-                              ],
-                              "allowedValues": [
-                                1,
-                                2,
-                                3
-                              ],
-                              "metadata": {
-                                "description": "Optional. A list of availability zones denoting the IP allocated for the resource needs to come from."
-                              }
-                            },
-                            "publicIPAddressVersion": {
-                              "type": "string",
-                              "defaultValue": "IPv4",
-                              "allowedValues": [
-                                "IPv4",
-                                "IPv6"
-                              ],
-                              "metadata": {
-                                "description": "Optional. IP address version."
-                              }
-                            },
-                            "dnsSettings": {
-                              "$ref": "#/definitions/dnsSettingsType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The DNS settings of the public IP address."
-                              }
-                            },
-                            "lock": {
-                              "$ref": "#/definitions/lockType",
-                              "metadata": {
-                                "description": "Optional. The lock settings of the service."
-                              }
-                            },
-                            "skuName": {
-                              "type": "string",
-                              "defaultValue": "Standard",
-                              "allowedValues": [
-                                "Basic",
-                                "Standard"
-                              ],
-                              "metadata": {
-                                "description": "Optional. Name of a public IP address SKU."
-                              }
-                            },
-                            "skuTier": {
-                              "type": "string",
-                              "defaultValue": "Regional",
-                              "allowedValues": [
-                                "Global",
-                                "Regional"
-                              ],
-                              "metadata": {
-                                "description": "Optional. Tier of a public IP address SKU."
-                              }
-                            },
-                            "ddosSettings": {
-                              "$ref": "#/definitions/ddosSettingsType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The DDoS protection plan configuration associated with the public IP address."
-                              }
-                            },
-                            "location": {
-                              "type": "string",
-                              "defaultValue": "[resourceGroup().location]",
-                              "metadata": {
-                                "description": "Optional. Location for all resources."
-                              }
-                            },
-                            "roleAssignments": {
-                              "$ref": "#/definitions/roleAssignmentType",
-                              "metadata": {
-                                "description": "Optional. Array of role assignments to create."
-                              }
-                            },
-                            "enableTelemetry": {
-                              "type": "bool",
-                              "defaultValue": true,
-                              "metadata": {
-                                "description": "Optional. Enable/Disable usage telemetry for module."
-                              }
-                            },
-                            "idleTimeoutInMinutes": {
-                              "type": "int",
-                              "defaultValue": 4,
-                              "metadata": {
-                                "description": "Optional. The idle timeout of the public IP address."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Tags of the resource."
-                              }
-                            },
-                            "diagnosticSettings": {
-                              "$ref": "#/definitions/diagnosticSettingType",
-                              "metadata": {
-                                "description": "Optional. The diagnostic settings of the service."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "copy": [
-                              {
-                                "name": "formattedRoleAssignments",
-                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                              }
-                            ],
-                            "builtInRoleNames": {
-                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
-                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
-                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
-                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
-                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
-                            }
-                          },
-                          "resources": {
-                            "avmTelemetry": {
-                              "condition": "[parameters('enableTelemetry')]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2024-03-01",
-                              "name": "[format('46d3xbcp.res.network-publicipaddress.{0}.{1}', replace('0.6.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                              "properties": {
-                                "mode": "Incremental",
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "contentVersion": "1.0.0.0",
-                                  "resources": [],
-                                  "outputs": {
-                                    "telemetry": {
-                                      "type": "String",
-                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                    }
-                                  }
-                                }
-                              }
-                            },
-                            "publicIpAddress": {
-                              "type": "Microsoft.Network/publicIPAddresses",
-                              "apiVersion": "2023-09-01",
-                              "name": "[parameters('name')]",
-                              "location": "[parameters('location')]",
-                              "tags": "[parameters('tags')]",
-                              "sku": {
-                                "name": "[parameters('skuName')]",
-                                "tier": "[parameters('skuTier')]"
-                              },
-                              "zones": "[map(parameters('zones'), lambda('zone', string(lambdaVariables('zone'))))]",
-                              "properties": {
-                                "ddosSettings": "[parameters('ddosSettings')]",
-                                "dnsSettings": "[parameters('dnsSettings')]",
-                                "publicIPAddressVersion": "[parameters('publicIPAddressVersion')]",
-                                "publicIPAllocationMethod": "[parameters('publicIPAllocationMethod')]",
-                                "publicIPPrefix": "[if(not(empty(parameters('publicIpPrefixResourceId'))), createObject('id', parameters('publicIpPrefixResourceId')), null())]",
-                                "idleTimeoutInMinutes": "[parameters('idleTimeoutInMinutes')]",
-                                "ipTags": null
-                              }
-                            },
-                            "publicIpAddress_lock": {
-                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                              "type": "Microsoft.Authorization/locks",
-                              "apiVersion": "2020-05-01",
-                              "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
-                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                              "properties": {
-                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-                              },
-                              "dependsOn": [
-                                "publicIpAddress"
-                              ]
-                            },
-                            "publicIpAddress_roleAssignments": {
-                              "copy": {
-                                "name": "publicIpAddress_roleAssignments",
-                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                              },
-                              "type": "Microsoft.Authorization/roleAssignments",
-                              "apiVersion": "2022-04-01",
-                              "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
-                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/publicIPAddresses', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                              "properties": {
-                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                              },
-                              "dependsOn": [
-                                "publicIpAddress"
-                              ]
-                            },
-                            "publicIpAddress_diagnosticSettings": {
-                              "copy": {
-                                "name": "publicIpAddress_diagnosticSettings",
-                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                              },
-                              "type": "Microsoft.Insights/diagnosticSettings",
-                              "apiVersion": "2021-05-01-preview",
-                              "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
-                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-                              "properties": {
-                                "copy": [
-                                  {
-                                    "name": "metrics",
-                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                                    "input": {
-                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                                      "timeGrain": null
-                                    }
-                                  },
-                                  {
-                                    "name": "logs",
-                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                                    "input": {
-                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                                    }
-                                  }
-                                ],
-                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                              },
-                              "dependsOn": [
-                                "publicIpAddress"
-                              ]
-                            }
-                          },
-                          "outputs": {
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group the public IP address was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the public IP address."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the public IP address."
-                              },
-                              "value": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('name'))]"
-                            },
-                            "ipAddress": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The public IP address of the public IP address resource."
-                              },
-                              "value": "[coalesce(tryGet(reference('publicIpAddress'), 'ipAddress'), '')]"
-                            },
-                            "location": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The location the resource was deployed into."
-                              },
-                              "value": "[reference('publicIpAddress', '2023-09-01', 'full').location]"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "networkInterface": {
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-NetworkInterface', deployment().name)]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[parameters('networkInterfaceName')]"
-                          },
-                          "ipConfigurations": {
-                            "copy": [
-                              {
-                                "name": "value",
-                                "count": "[length(parameters('ipConfigurations'))]",
-                                "input": "[createObject('name', if(not(empty(parameters('ipConfigurations')[copyIndex('value')].name)), parameters('ipConfigurations')[copyIndex('value')].name, null()), 'primary', equals(copyIndex('value'), 0), 'privateIPAllocationMethod', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'privateIPAllocationMethod'), if(not(empty(parameters('ipConfigurations')[copyIndex('value')].privateIPAllocationMethod)), parameters('ipConfigurations')[copyIndex('value')].privateIPAllocationMethod, null()), null()), 'privateIPAddress', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'privateIPAddress'), if(not(empty(parameters('ipConfigurations')[copyIndex('value')].privateIPAddress)), parameters('ipConfigurations')[copyIndex('value')].privateIPAddress, null()), null()), 'publicIPAddressResourceId', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'pipConfiguration'), if(not(contains(parameters('ipConfigurations')[copyIndex('value')].pipConfiguration, 'publicIPAddressResourceId')), resourceId('Microsoft.Network/publicIPAddresses', coalesce(tryGet(parameters('ipConfigurations')[copyIndex('value')].pipConfiguration, 'name'), format('{0}{1}', parameters('virtualMachineName'), tryGet(parameters('ipConfigurations')[copyIndex('value')].pipConfiguration, 'publicIpNameSuffix')))), parameters('ipConfigurations')[copyIndex('value')].pipConfiguration.publicIPAddressResourceId), null()), 'subnetResourceId', parameters('ipConfigurations')[copyIndex('value')].subnetResourceId, 'loadBalancerBackendAddressPools', coalesce(tryGet(parameters('ipConfigurations')[copyIndex('value')], 'loadBalancerBackendAddressPools'), null()), 'applicationSecurityGroups', coalesce(tryGet(parameters('ipConfigurations')[copyIndex('value')], 'applicationSecurityGroups'), null()), 'applicationGatewayBackendAddressPools', coalesce(tryGet(parameters('ipConfigurations')[copyIndex('value')], 'applicationGatewayBackendAddressPools'), null()), 'gatewayLoadBalancer', coalesce(tryGet(parameters('ipConfigurations')[copyIndex('value')], 'gatewayLoadBalancer'), null()), 'loadBalancerInboundNatRules', coalesce(tryGet(parameters('ipConfigurations')[copyIndex('value')], 'loadBalancerInboundNatRules'), null()), 'privateIPAddressVersion', coalesce(tryGet(parameters('ipConfigurations')[copyIndex('value')], 'privateIPAddressVersion'), null()), 'virtualNetworkTaps', coalesce(tryGet(parameters('ipConfigurations')[copyIndex('value')], 'virtualNetworkTaps'), null()))]"
-                              }
-                            ]
-                          },
-                          "location": {
-                            "value": "[parameters('location')]"
-                          },
-                          "tags": {
-                            "value": "[parameters('tags')]"
-                          },
-                          "diagnosticSettings": {
-                            "value": "[parameters('diagnosticSettings')]"
-                          },
-                          "dnsServers": "[if(not(empty(parameters('dnsServers'))), createObject('value', parameters('dnsServers')), createObject('value', createArray()))]",
-                          "enableAcceleratedNetworking": {
-                            "value": "[parameters('enableAcceleratedNetworking')]"
-                          },
-                          "enableTelemetry": {
-                            "value": "[parameters('enableTelemetry')]"
-                          },
-                          "enableIPForwarding": {
-                            "value": "[parameters('enableIPForwarding')]"
-                          },
-                          "lock": {
-                            "value": "[parameters('lock')]"
-                          },
-                          "networkSecurityGroupResourceId": "[if(not(empty(parameters('networkSecurityGroupResourceId'))), createObject('value', parameters('networkSecurityGroupResourceId')), createObject('value', ''))]",
-                          "roleAssignments": "[if(not(empty(parameters('roleAssignments'))), createObject('value', parameters('roleAssignments')), createObject('value', createArray()))]"
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.29.47.4906",
-                              "templateHash": "9226998037927576702"
-                            },
-                            "name": "Network Interface",
-                            "description": "This module deploys a Network Interface.",
-                            "owner": "Azure/module-maintainers"
-                          },
-                          "definitions": {
-                            "diagnosticSettingType": {
-                              "type": "array",
-                              "items": {
-                                "type": "object",
-                                "properties": {
-                                  "name": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The name of diagnostic setting."
-                                    }
-                                  },
-                                  "logCategoriesAndGroups": {
-                                    "type": "array",
-                                    "items": {
-                                      "type": "object",
-                                      "properties": {
-                                        "category": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                          }
-                                        },
-                                        "categoryGroup": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                          }
-                                        },
-                                        "enabled": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                          }
-                                        }
-                                      }
-                                    },
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                                    }
-                                  },
-                                  "metricCategories": {
-                                    "type": "array",
-                                    "items": {
-                                      "type": "object",
-                                      "properties": {
-                                        "category": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                          }
-                                        },
-                                        "enabled": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                          }
-                                        }
-                                      }
-                                    },
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                                    }
-                                  },
-                                  "logAnalyticsDestinationType": {
-                                    "type": "string",
-                                    "allowedValues": [
-                                      "AzureDiagnostics",
-                                      "Dedicated"
-                                    ],
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                                    }
-                                  },
-                                  "workspaceResourceId": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                    }
-                                  },
-                                  "storageAccountResourceId": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                    }
-                                  },
-                                  "eventHubAuthorizationRuleResourceId": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                                    }
-                                  },
-                                  "eventHubName": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                    }
-                                  },
-                                  "marketplacePartnerResourceId": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                                    }
-                                  }
-                                }
-                              },
-                              "nullable": true
-                            },
-                            "roleAssignmentType": {
-                              "type": "array",
-                              "items": {
-                                "type": "object",
-                                "properties": {
-                                  "name": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                    }
-                                  },
-                                  "roleDefinitionIdOrName": {
-                                    "type": "string",
-                                    "metadata": {
-                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                    }
-                                  },
-                                  "principalId": {
-                                    "type": "string",
-                                    "metadata": {
-                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                    }
-                                  },
-                                  "principalType": {
-                                    "type": "string",
-                                    "allowedValues": [
-                                      "Device",
-                                      "ForeignGroup",
-                                      "Group",
-                                      "ServicePrincipal",
-                                      "User"
-                                    ],
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The principal type of the assigned principal ID."
-                                    }
-                                  },
-                                  "description": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The description of the role assignment."
-                                    }
-                                  },
-                                  "condition": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                    }
-                                  },
-                                  "conditionVersion": {
-                                    "type": "string",
-                                    "allowedValues": [
-                                      "2.0"
-                                    ],
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. Version of the condition."
-                                    }
-                                  },
-                                  "delegatedManagedIdentityResourceId": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                    }
-                                  }
-                                }
-                              },
-                              "nullable": true
-                            },
-                            "lockType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the name of lock."
-                                  }
-                                },
-                                "kind": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "CanNotDelete",
-                                    "None",
-                                    "ReadOnly"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the type of lock."
-                                  }
-                                }
-                              },
-                              "nullable": true
-                            }
-                          },
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The name of the network interface."
-                              }
-                            },
-                            "location": {
-                              "type": "string",
-                              "defaultValue": "[resourceGroup().location]",
-                              "metadata": {
-                                "description": "Optional. Location for all resources."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Resource tags."
-                              }
-                            },
-                            "enableTelemetry": {
-                              "type": "bool",
-                              "defaultValue": true,
-                              "metadata": {
-                                "description": "Optional. Enable/Disable usage telemetry for module."
-                              }
-                            },
-                            "enableIPForwarding": {
-                              "type": "bool",
-                              "defaultValue": false,
-                              "metadata": {
-                                "description": "Optional. Indicates whether IP forwarding is enabled on this network interface."
-                              }
-                            },
-                            "enableAcceleratedNetworking": {
-                              "type": "bool",
-                              "defaultValue": false,
-                              "metadata": {
-                                "description": "Optional. If the network interface is accelerated networking enabled."
-                              }
-                            },
-                            "dnsServers": {
-                              "type": "array",
-                              "defaultValue": [],
-                              "metadata": {
-                                "description": "Optional. List of DNS servers IP addresses. Use 'AzureProvidedDNS' to switch to azure provided DNS resolution. 'AzureProvidedDNS' value cannot be combined with other IPs, it must be the only value in dnsServers collection."
-                              }
-                            },
-                            "networkSecurityGroupResourceId": {
-                              "type": "string",
-                              "defaultValue": "",
-                              "metadata": {
-                                "description": "Optional. The network security group (NSG) to attach to the network interface."
-                              }
-                            },
-                            "auxiliaryMode": {
-                              "type": "string",
-                              "defaultValue": "None",
-                              "allowedValues": [
-                                "Floating",
-                                "MaxConnections",
-                                "None"
-                              ],
-                              "metadata": {
-                                "description": "Optional. Auxiliary mode of Network Interface resource. Not all regions are enabled for Auxiliary Mode Nic."
-                              }
-                            },
-                            "auxiliarySku": {
-                              "type": "string",
-                              "defaultValue": "None",
-                              "allowedValues": [
-                                "A1",
-                                "A2",
-                                "A4",
-                                "A8",
-                                "None"
-                              ],
-                              "metadata": {
-                                "description": "Optional. Auxiliary sku of Network Interface resource. Not all regions are enabled for Auxiliary Mode Nic."
-                              }
-                            },
-                            "disableTcpStateTracking": {
-                              "type": "bool",
-                              "defaultValue": false,
-                              "metadata": {
-                                "description": "Optional. Indicates whether to disable tcp state tracking. Subscription must be registered for the Microsoft.Network/AllowDisableTcpStateTracking feature before this property can be set to true."
-                              }
-                            },
-                            "ipConfigurations": {
-                              "type": "array",
-                              "metadata": {
-                                "description": "Required. A list of IPConfigurations of the network interface."
-                              }
-                            },
-                            "lock": {
-                              "$ref": "#/definitions/lockType",
-                              "metadata": {
-                                "description": "Optional. The lock settings of the service."
-                              }
-                            },
-                            "roleAssignments": {
-                              "$ref": "#/definitions/roleAssignmentType",
-                              "metadata": {
-                                "description": "Optional. Array of role assignments to create."
-                              }
-                            },
-                            "diagnosticSettings": {
-                              "$ref": "#/definitions/diagnosticSettingType",
-                              "metadata": {
-                                "description": "Optional. The diagnostic settings of the service."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "copy": [
-                              {
-                                "name": "formattedRoleAssignments",
-                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                              }
-                            ],
-                            "builtInRoleNames": {
-                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
-                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
-                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
-                            }
-                          },
-                          "resources": {
-                            "avmTelemetry": {
-                              "condition": "[parameters('enableTelemetry')]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2024-03-01",
-                              "name": "[format('46d3xbcp.res.network-networkinterface.{0}.{1}', replace('0.4.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                              "properties": {
-                                "mode": "Incremental",
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "contentVersion": "1.0.0.0",
-                                  "resources": [],
-                                  "outputs": {
-                                    "telemetry": {
-                                      "type": "String",
-                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                    }
-                                  }
-                                }
-                              }
-                            },
-                            "networkInterface": {
-                              "type": "Microsoft.Network/networkInterfaces",
-                              "apiVersion": "2023-04-01",
-                              "name": "[parameters('name')]",
-                              "location": "[parameters('location')]",
-                              "tags": "[parameters('tags')]",
-                              "properties": {
-                                "copy": [
-                                  {
-                                    "name": "ipConfigurations",
-                                    "count": "[length(parameters('ipConfigurations'))]",
-                                    "input": {
-                                      "name": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'name'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].name, format('ipconfig0{0}', add(copyIndex('ipConfigurations'), 1)))]",
-                                      "properties": {
-                                        "primary": "[if(equals(copyIndex('ipConfigurations'), 0), true(), false())]",
-                                        "privateIPAllocationMethod": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'privateIPAllocationMethod'), if(not(empty(parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAllocationMethod)), parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAllocationMethod, null()), null())]",
-                                        "privateIPAddress": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'privateIPAddress'), if(not(empty(parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAddress)), parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAddress, null()), null())]",
-                                        "publicIPAddress": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'publicIPAddressResourceId'), if(not(equals(parameters('ipConfigurations')[copyIndex('ipConfigurations')].publicIPAddressResourceId, null())), createObject('id', parameters('ipConfigurations')[copyIndex('ipConfigurations')].publicIPAddressResourceId), null()), null())]",
-                                        "subnet": {
-                                          "id": "[parameters('ipConfigurations')[copyIndex('ipConfigurations')].subnetResourceId]"
-                                        },
-                                        "loadBalancerBackendAddressPools": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'loadBalancerBackendAddressPools'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].loadBalancerBackendAddressPools, null())]",
-                                        "applicationSecurityGroups": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'applicationSecurityGroups'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].applicationSecurityGroups, null())]",
-                                        "applicationGatewayBackendAddressPools": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'applicationGatewayBackendAddressPools'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].applicationGatewayBackendAddressPools, null())]",
-                                        "gatewayLoadBalancer": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'gatewayLoadBalancer'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].gatewayLoadBalancer, null())]",
-                                        "loadBalancerInboundNatRules": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'loadBalancerInboundNatRules'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].loadBalancerInboundNatRules, null())]",
-                                        "privateIPAddressVersion": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'privateIPAddressVersion'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAddressVersion, null())]",
-                                        "virtualNetworkTaps": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'virtualNetworkTaps'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].virtualNetworkTaps, null())]"
-                                      }
-                                    }
-                                  }
-                                ],
-                                "auxiliaryMode": "[parameters('auxiliaryMode')]",
-                                "auxiliarySku": "[parameters('auxiliarySku')]",
-                                "disableTcpStateTracking": "[parameters('disableTcpStateTracking')]",
-                                "dnsSettings": "[if(not(empty(parameters('dnsServers'))), createObject('dnsServers', parameters('dnsServers')), null())]",
-                                "enableAcceleratedNetworking": "[parameters('enableAcceleratedNetworking')]",
-                                "enableIPForwarding": "[parameters('enableIPForwarding')]",
-                                "networkSecurityGroup": "[if(not(empty(parameters('networkSecurityGroupResourceId'))), createObject('id', parameters('networkSecurityGroupResourceId')), null())]"
-                              }
-                            },
-                            "networkInterface_lock": {
-                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                              "type": "Microsoft.Authorization/locks",
-                              "apiVersion": "2020-05-01",
-                              "scope": "[format('Microsoft.Network/networkInterfaces/{0}', parameters('name'))]",
-                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                              "properties": {
-                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-                              },
-                              "dependsOn": [
-                                "networkInterface"
-                              ]
-                            },
-                            "networkInterface_diagnosticSettings": {
-                              "copy": {
-                                "name": "networkInterface_diagnosticSettings",
-                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                              },
-                              "type": "Microsoft.Insights/diagnosticSettings",
-                              "apiVersion": "2021-05-01-preview",
-                              "scope": "[format('Microsoft.Network/networkInterfaces/{0}', parameters('name'))]",
-                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-                              "properties": {
-                                "copy": [
-                                  {
-                                    "name": "metrics",
-                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                                    "input": {
-                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                                      "timeGrain": null
-                                    }
-                                  }
-                                ],
-                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                              },
-                              "dependsOn": [
-                                "networkInterface"
-                              ]
-                            },
-                            "networkInterface_roleAssignments": {
-                              "copy": {
-                                "name": "networkInterface_roleAssignments",
-                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                              },
-                              "type": "Microsoft.Authorization/roleAssignments",
-                              "apiVersion": "2022-04-01",
-                              "scope": "[format('Microsoft.Network/networkInterfaces/{0}', parameters('name'))]",
-                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/networkInterfaces', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                              "properties": {
-                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                              },
-                              "dependsOn": [
-                                "networkInterface"
-                              ]
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the deployed resource."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the deployed resource."
-                              },
-                              "value": "[resourceId('Microsoft.Network/networkInterfaces', parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group of the deployed resource."
-                              },
-                              "value": "[resourceGroup().name]"
-                            },
-                            "location": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The location the resource was deployed into."
-                              },
-                              "value": "[reference('networkInterface', '2023-04-01', 'full').location]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "networkInterface_publicIPAddresses"
-                      ]
-                    }
-                  }
-                }
-              }
-            },
-            "vm_aadJoinExtension": {
-              "condition": "[parameters('extensionAadJoinConfig').enabled]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-VM-AADLogin', uniqueString(deployment().name, parameters('location')))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "virtualMachineName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "AADLogin"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "publisher": {
-                    "value": "Microsoft.Azure.ActiveDirectory"
-                  },
-                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AADLoginForWindows'), createObject('value', 'AADSSHLoginforLinux'))]",
-                  "typeHandlerVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'typeHandlerVersion'), if(equals(parameters('osType'), 'Windows'), '2.0', '1.0'))]"
-                  },
-                  "autoUpgradeMinorVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'autoUpgradeMinorVersion'), true())]"
-                  },
-                  "enableAutomaticUpgrade": {
-                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'enableAutomaticUpgrade'), false())]"
-                  },
-                  "settings": {
-                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'settings'), createObject())]"
-                  },
-                  "supressFailures": {
-                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'supressFailures'), false())]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'tags'), parameters('tags'))]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "8482591295619883067"
-                    },
-                    "name": "Virtual Machine Extensions",
-                    "description": "This module deploys a Virtual Machine Extension."
-                  },
-                  "parameters": {
-                    "virtualMachineName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the virtual machine extension."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. The location the extension is deployed to."
-                      }
-                    },
-                    "publisher": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the extension handler publisher."
-                      }
-                    },
-                    "type": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
-                      }
-                    },
-                    "typeHandlerVersion": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the version of the script handler."
-                      }
-                    },
-                    "autoUpgradeMinorVersion": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
-                      }
-                    },
-                    "forceUpdateTag": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
-                      }
-                    },
-                    "settings": {
-                      "type": "object",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific settings."
-                      }
-                    },
-                    "protectedSettings": {
-                      "type": "secureObject",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific protected settings."
-                      }
-                    },
-                    "supressFailures": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
-                      }
-                    },
-                    "enableAutomaticUpgrade": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the resource."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "virtualMachine": {
-                      "existing": true,
-                      "type": "Microsoft.Compute/virtualMachines",
-                      "apiVersion": "2022-11-01",
-                      "name": "[parameters('virtualMachineName')]"
-                    },
-                    "extension": {
-                      "type": "Microsoft.Compute/virtualMachines/extensions",
-                      "apiVersion": "2022-11-01",
-                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "publisher": "[parameters('publisher')]",
-                        "type": "[parameters('type')]",
-                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
-                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
-                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
-                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
-                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
-                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
-                        "suppressFailures": "[parameters('supressFailures')]"
-                      }
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the extension."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the extension."
-                      },
-                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the Resource Group the extension was created in."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('extension', '2022-11-01', 'full').location]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "vm"
-              ]
-            },
-            "vm_domainJoinExtension": {
-              "condition": "[and(contains(parameters('extensionDomainJoinConfig'), 'enabled'), parameters('extensionDomainJoinConfig').enabled)]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-VM-DomainJoin', uniqueString(deployment().name, parameters('location')))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "virtualMachineName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "DomainJoin"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "publisher": {
-                    "value": "Microsoft.Compute"
-                  },
-                  "type": {
-                    "value": "JsonADDomainExtension"
-                  },
-                  "typeHandlerVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'typeHandlerVersion'), '1.3')]"
-                  },
-                  "autoUpgradeMinorVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'autoUpgradeMinorVersion'), true())]"
-                  },
-                  "enableAutomaticUpgrade": {
-                    "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'enableAutomaticUpgrade'), false())]"
-                  },
-                  "settings": {
-                    "value": "[parameters('extensionDomainJoinConfig').settings]"
-                  },
-                  "supressFailures": {
-                    "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'supressFailures'), false())]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'tags'), parameters('tags'))]"
-                  },
-                  "protectedSettings": {
-                    "value": {
-                      "Password": "[parameters('extensionDomainJoinPassword')]"
-                    }
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "8482591295619883067"
-                    },
-                    "name": "Virtual Machine Extensions",
-                    "description": "This module deploys a Virtual Machine Extension."
-                  },
-                  "parameters": {
-                    "virtualMachineName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the virtual machine extension."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. The location the extension is deployed to."
-                      }
-                    },
-                    "publisher": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the extension handler publisher."
-                      }
-                    },
-                    "type": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
-                      }
-                    },
-                    "typeHandlerVersion": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the version of the script handler."
-                      }
-                    },
-                    "autoUpgradeMinorVersion": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
-                      }
-                    },
-                    "forceUpdateTag": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
-                      }
-                    },
-                    "settings": {
-                      "type": "object",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific settings."
-                      }
-                    },
-                    "protectedSettings": {
-                      "type": "secureObject",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific protected settings."
-                      }
-                    },
-                    "supressFailures": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
-                      }
-                    },
-                    "enableAutomaticUpgrade": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the resource."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "virtualMachine": {
-                      "existing": true,
-                      "type": "Microsoft.Compute/virtualMachines",
-                      "apiVersion": "2022-11-01",
-                      "name": "[parameters('virtualMachineName')]"
-                    },
-                    "extension": {
-                      "type": "Microsoft.Compute/virtualMachines/extensions",
-                      "apiVersion": "2022-11-01",
-                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "publisher": "[parameters('publisher')]",
-                        "type": "[parameters('type')]",
-                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
-                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
-                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
-                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
-                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
-                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
-                        "suppressFailures": "[parameters('supressFailures')]"
-                      }
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the extension."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the extension."
-                      },
-                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the Resource Group the extension was created in."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('extension', '2022-11-01', 'full').location]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "vm",
-                "vm_aadJoinExtension"
-              ]
-            },
-            "vm_microsoftAntiMalwareExtension": {
-              "condition": "[parameters('extensionAntiMalwareConfig').enabled]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-VM-MicrosoftAntiMalware', uniqueString(deployment().name, parameters('location')))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "virtualMachineName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "MicrosoftAntiMalware"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "publisher": {
-                    "value": "Microsoft.Azure.Security"
-                  },
-                  "type": {
-                    "value": "IaaSAntimalware"
-                  },
-                  "typeHandlerVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'typeHandlerVersion'), '1.3')]"
-                  },
-                  "autoUpgradeMinorVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'autoUpgradeMinorVersion'), true())]"
-                  },
-                  "enableAutomaticUpgrade": {
-                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'enableAutomaticUpgrade'), false())]"
-                  },
-                  "settings": {
-                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'settings'), createObject('AntimalwareEnabled', 'true', 'Exclusions', createObject(), 'RealtimeProtectionEnabled', 'true', 'ScheduledScanSettings', createObject('day', '7', 'isEnabled', 'true', 'scanType', 'Quick', 'time', '120')))]"
-                  },
-                  "supressFailures": {
-                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'supressFailures'), false())]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'tags'), parameters('tags'))]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "8482591295619883067"
-                    },
-                    "name": "Virtual Machine Extensions",
-                    "description": "This module deploys a Virtual Machine Extension."
-                  },
-                  "parameters": {
-                    "virtualMachineName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the virtual machine extension."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. The location the extension is deployed to."
-                      }
-                    },
-                    "publisher": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the extension handler publisher."
-                      }
-                    },
-                    "type": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
-                      }
-                    },
-                    "typeHandlerVersion": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the version of the script handler."
-                      }
-                    },
-                    "autoUpgradeMinorVersion": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
-                      }
-                    },
-                    "forceUpdateTag": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
-                      }
-                    },
-                    "settings": {
-                      "type": "object",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific settings."
-                      }
-                    },
-                    "protectedSettings": {
-                      "type": "secureObject",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific protected settings."
-                      }
-                    },
-                    "supressFailures": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
-                      }
-                    },
-                    "enableAutomaticUpgrade": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the resource."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "virtualMachine": {
-                      "existing": true,
-                      "type": "Microsoft.Compute/virtualMachines",
-                      "apiVersion": "2022-11-01",
-                      "name": "[parameters('virtualMachineName')]"
-                    },
-                    "extension": {
-                      "type": "Microsoft.Compute/virtualMachines/extensions",
-                      "apiVersion": "2022-11-01",
-                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "publisher": "[parameters('publisher')]",
-                        "type": "[parameters('type')]",
-                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
-                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
-                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
-                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
-                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
-                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
-                        "suppressFailures": "[parameters('supressFailures')]"
-                      }
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the extension."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the extension."
-                      },
-                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the Resource Group the extension was created in."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('extension', '2022-11-01', 'full').location]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "vm",
-                "vm_domainJoinExtension"
-              ]
-            },
-            "vm_azureMonitorAgentExtension": {
-              "condition": "[parameters('extensionMonitoringAgentConfig').enabled]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-VM-AzureMonitorAgent', uniqueString(deployment().name, parameters('location')))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "virtualMachineName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "AzureMonitorAgent"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "publisher": {
-                    "value": "Microsoft.Azure.Monitor"
-                  },
-                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AzureMonitorWindowsAgent'), createObject('value', 'AzureMonitorLinuxAgent'))]",
-                  "typeHandlerVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'typeHandlerVersion'), if(equals(parameters('osType'), 'Windows'), '1.22', '1.29'))]"
-                  },
-                  "autoUpgradeMinorVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'autoUpgradeMinorVersion'), true())]"
-                  },
-                  "enableAutomaticUpgrade": {
-                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'enableAutomaticUpgrade'), false())]"
-                  },
-                  "supressFailures": {
-                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'supressFailures'), false())]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'tags'), parameters('tags'))]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "8482591295619883067"
-                    },
-                    "name": "Virtual Machine Extensions",
-                    "description": "This module deploys a Virtual Machine Extension."
-                  },
-                  "parameters": {
-                    "virtualMachineName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the virtual machine extension."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. The location the extension is deployed to."
-                      }
-                    },
-                    "publisher": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the extension handler publisher."
-                      }
-                    },
-                    "type": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
-                      }
-                    },
-                    "typeHandlerVersion": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the version of the script handler."
-                      }
-                    },
-                    "autoUpgradeMinorVersion": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
-                      }
-                    },
-                    "forceUpdateTag": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
-                      }
-                    },
-                    "settings": {
-                      "type": "object",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific settings."
-                      }
-                    },
-                    "protectedSettings": {
-                      "type": "secureObject",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific protected settings."
-                      }
-                    },
-                    "supressFailures": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
-                      }
-                    },
-                    "enableAutomaticUpgrade": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the resource."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "virtualMachine": {
-                      "existing": true,
-                      "type": "Microsoft.Compute/virtualMachines",
-                      "apiVersion": "2022-11-01",
-                      "name": "[parameters('virtualMachineName')]"
-                    },
-                    "extension": {
-                      "type": "Microsoft.Compute/virtualMachines/extensions",
-                      "apiVersion": "2022-11-01",
-                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "publisher": "[parameters('publisher')]",
-                        "type": "[parameters('type')]",
-                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
-                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
-                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
-                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
-                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
-                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
-                        "suppressFailures": "[parameters('supressFailures')]"
-                      }
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the extension."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the extension."
-                      },
-                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the Resource Group the extension was created in."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('extension', '2022-11-01', 'full').location]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "vm",
-                "vm_microsoftAntiMalwareExtension"
-              ]
-            },
-            "vm_dependencyAgentExtension": {
-              "condition": "[parameters('extensionDependencyAgentConfig').enabled]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-VM-DependencyAgent', uniqueString(deployment().name, parameters('location')))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "virtualMachineName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "DependencyAgent"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "publisher": {
-                    "value": "Microsoft.Azure.Monitoring.DependencyAgent"
-                  },
-                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'DependencyAgentWindows'), createObject('value', 'DependencyAgentLinux'))]",
-                  "typeHandlerVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'typeHandlerVersion'), '9.10')]"
-                  },
-                  "autoUpgradeMinorVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'autoUpgradeMinorVersion'), true())]"
-                  },
-                  "enableAutomaticUpgrade": {
-                    "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'enableAutomaticUpgrade'), true())]"
-                  },
-                  "settings": {
-                    "value": {
-                      "enableAMA": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'enableAMA'), true())]"
-                    }
-                  },
-                  "supressFailures": {
-                    "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'supressFailures'), false())]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'tags'), parameters('tags'))]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "8482591295619883067"
-                    },
-                    "name": "Virtual Machine Extensions",
-                    "description": "This module deploys a Virtual Machine Extension."
-                  },
-                  "parameters": {
-                    "virtualMachineName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the virtual machine extension."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. The location the extension is deployed to."
-                      }
-                    },
-                    "publisher": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the extension handler publisher."
-                      }
-                    },
-                    "type": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
-                      }
-                    },
-                    "typeHandlerVersion": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the version of the script handler."
-                      }
-                    },
-                    "autoUpgradeMinorVersion": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
-                      }
-                    },
-                    "forceUpdateTag": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
-                      }
-                    },
-                    "settings": {
-                      "type": "object",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific settings."
-                      }
-                    },
-                    "protectedSettings": {
-                      "type": "secureObject",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific protected settings."
-                      }
-                    },
-                    "supressFailures": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
-                      }
-                    },
-                    "enableAutomaticUpgrade": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the resource."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "virtualMachine": {
-                      "existing": true,
-                      "type": "Microsoft.Compute/virtualMachines",
-                      "apiVersion": "2022-11-01",
-                      "name": "[parameters('virtualMachineName')]"
-                    },
-                    "extension": {
-                      "type": "Microsoft.Compute/virtualMachines/extensions",
-                      "apiVersion": "2022-11-01",
-                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "publisher": "[parameters('publisher')]",
-                        "type": "[parameters('type')]",
-                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
-                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
-                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
-                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
-                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
-                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
-                        "suppressFailures": "[parameters('supressFailures')]"
-                      }
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the extension."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the extension."
-                      },
-                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the Resource Group the extension was created in."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('extension', '2022-11-01', 'full').location]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "vm",
-                "vm_azureMonitorAgentExtension"
-              ]
-            },
-            "vm_networkWatcherAgentExtension": {
-              "condition": "[parameters('extensionNetworkWatcherAgentConfig').enabled]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-VM-NetworkWatcherAgent', uniqueString(deployment().name, parameters('location')))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "virtualMachineName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "NetworkWatcherAgent"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "publisher": {
-                    "value": "Microsoft.Azure.NetworkWatcher"
-                  },
-                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'NetworkWatcherAgentWindows'), createObject('value', 'NetworkWatcherAgentLinux'))]",
-                  "typeHandlerVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'typeHandlerVersion'), '1.4')]"
-                  },
-                  "autoUpgradeMinorVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'autoUpgradeMinorVersion'), true())]"
-                  },
-                  "enableAutomaticUpgrade": {
-                    "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'enableAutomaticUpgrade'), false())]"
-                  },
-                  "supressFailures": {
-                    "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'supressFailures'), false())]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'tags'), parameters('tags'))]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "8482591295619883067"
-                    },
-                    "name": "Virtual Machine Extensions",
-                    "description": "This module deploys a Virtual Machine Extension."
-                  },
-                  "parameters": {
-                    "virtualMachineName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the virtual machine extension."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. The location the extension is deployed to."
-                      }
-                    },
-                    "publisher": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the extension handler publisher."
-                      }
-                    },
-                    "type": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
-                      }
-                    },
-                    "typeHandlerVersion": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the version of the script handler."
-                      }
-                    },
-                    "autoUpgradeMinorVersion": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
-                      }
-                    },
-                    "forceUpdateTag": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
-                      }
-                    },
-                    "settings": {
-                      "type": "object",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific settings."
-                      }
-                    },
-                    "protectedSettings": {
-                      "type": "secureObject",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific protected settings."
-                      }
-                    },
-                    "supressFailures": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
-                      }
-                    },
-                    "enableAutomaticUpgrade": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the resource."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "virtualMachine": {
-                      "existing": true,
-                      "type": "Microsoft.Compute/virtualMachines",
-                      "apiVersion": "2022-11-01",
-                      "name": "[parameters('virtualMachineName')]"
-                    },
-                    "extension": {
-                      "type": "Microsoft.Compute/virtualMachines/extensions",
-                      "apiVersion": "2022-11-01",
-                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "publisher": "[parameters('publisher')]",
-                        "type": "[parameters('type')]",
-                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
-                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
-                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
-                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
-                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
-                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
-                        "suppressFailures": "[parameters('supressFailures')]"
-                      }
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the extension."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the extension."
-                      },
-                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the Resource Group the extension was created in."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('extension', '2022-11-01', 'full').location]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "vm",
-                "vm_dependencyAgentExtension"
-              ]
-            },
-            "vm_desiredStateConfigurationExtension": {
-              "condition": "[parameters('extensionDSCConfig').enabled]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-VM-DesiredStateConfiguration', uniqueString(deployment().name, parameters('location')))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "virtualMachineName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "DesiredStateConfiguration"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "publisher": {
-                    "value": "Microsoft.Powershell"
-                  },
-                  "type": {
-                    "value": "DSC"
-                  },
-                  "typeHandlerVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'typeHandlerVersion'), '2.77')]"
-                  },
-                  "autoUpgradeMinorVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'autoUpgradeMinorVersion'), true())]"
-                  },
-                  "enableAutomaticUpgrade": {
-                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'enableAutomaticUpgrade'), false())]"
-                  },
-                  "settings": {
-                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'settings'), createObject())]"
-                  },
-                  "supressFailures": {
-                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'supressFailures'), false())]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'tags'), parameters('tags'))]"
-                  },
-                  "protectedSettings": {
-                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'protectedSettings'), createObject())]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "8482591295619883067"
-                    },
-                    "name": "Virtual Machine Extensions",
-                    "description": "This module deploys a Virtual Machine Extension."
-                  },
-                  "parameters": {
-                    "virtualMachineName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the virtual machine extension."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. The location the extension is deployed to."
-                      }
-                    },
-                    "publisher": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the extension handler publisher."
-                      }
-                    },
-                    "type": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
-                      }
-                    },
-                    "typeHandlerVersion": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the version of the script handler."
-                      }
-                    },
-                    "autoUpgradeMinorVersion": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
-                      }
-                    },
-                    "forceUpdateTag": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
-                      }
-                    },
-                    "settings": {
-                      "type": "object",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific settings."
-                      }
-                    },
-                    "protectedSettings": {
-                      "type": "secureObject",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific protected settings."
-                      }
-                    },
-                    "supressFailures": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
-                      }
-                    },
-                    "enableAutomaticUpgrade": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the resource."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "virtualMachine": {
-                      "existing": true,
-                      "type": "Microsoft.Compute/virtualMachines",
-                      "apiVersion": "2022-11-01",
-                      "name": "[parameters('virtualMachineName')]"
-                    },
-                    "extension": {
-                      "type": "Microsoft.Compute/virtualMachines/extensions",
-                      "apiVersion": "2022-11-01",
-                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "publisher": "[parameters('publisher')]",
-                        "type": "[parameters('type')]",
-                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
-                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
-                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
-                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
-                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
-                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
-                        "suppressFailures": "[parameters('supressFailures')]"
-                      }
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the extension."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the extension."
-                      },
-                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the Resource Group the extension was created in."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('extension', '2022-11-01', 'full').location]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "vm",
-                "vm_networkWatcherAgentExtension"
-              ]
-            },
-            "vm_customScriptExtension": {
-              "condition": "[parameters('extensionCustomScriptConfig').enabled]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-VM-CustomScriptExtension', uniqueString(deployment().name, parameters('location')))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "virtualMachineName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "CustomScriptExtension"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "publisher": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'Microsoft.Compute'), createObject('value', 'Microsoft.Azure.Extensions'))]",
-                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'CustomScriptExtension'), createObject('value', 'CustomScript'))]",
-                  "typeHandlerVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'typeHandlerVersion'), if(equals(parameters('osType'), 'Windows'), '1.10', '2.1'))]"
-                  },
-                  "autoUpgradeMinorVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'autoUpgradeMinorVersion'), true())]"
-                  },
-                  "enableAutomaticUpgrade": {
-                    "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'enableAutomaticUpgrade'), false())]"
-                  },
-                  "settings": {
-                    "value": {
-                      "copy": [
-                        {
-                          "name": "fileUris",
-                          "count": "[length(parameters('extensionCustomScriptConfig').fileData)]",
-                          "input": "[if(contains(parameters('extensionCustomScriptConfig').fileData[copyIndex('fileUris')], 'storageAccountId'), format('{0}?{1}', parameters('extensionCustomScriptConfig').fileData[copyIndex('fileUris')].uri, listAccountSas(parameters('extensionCustomScriptConfig').fileData[copyIndex('fileUris')].storageAccountId, '2019-04-01', variables('accountSasProperties')).accountSasToken), parameters('extensionCustomScriptConfig').fileData[copyIndex('fileUris')].uri)]"
-                        }
-                      ]
-                    }
-                  },
-                  "supressFailures": {
-                    "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'supressFailures'), false())]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'tags'), parameters('tags'))]"
-                  },
-                  "protectedSettings": {
-                    "value": "[parameters('extensionCustomScriptProtectedSetting')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "8482591295619883067"
-                    },
-                    "name": "Virtual Machine Extensions",
-                    "description": "This module deploys a Virtual Machine Extension."
-                  },
-                  "parameters": {
-                    "virtualMachineName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the virtual machine extension."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. The location the extension is deployed to."
-                      }
-                    },
-                    "publisher": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the extension handler publisher."
-                      }
-                    },
-                    "type": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
-                      }
-                    },
-                    "typeHandlerVersion": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the version of the script handler."
-                      }
-                    },
-                    "autoUpgradeMinorVersion": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
-                      }
-                    },
-                    "forceUpdateTag": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
-                      }
-                    },
-                    "settings": {
-                      "type": "object",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific settings."
-                      }
-                    },
-                    "protectedSettings": {
-                      "type": "secureObject",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific protected settings."
-                      }
-                    },
-                    "supressFailures": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
-                      }
-                    },
-                    "enableAutomaticUpgrade": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the resource."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "virtualMachine": {
-                      "existing": true,
-                      "type": "Microsoft.Compute/virtualMachines",
-                      "apiVersion": "2022-11-01",
-                      "name": "[parameters('virtualMachineName')]"
-                    },
-                    "extension": {
-                      "type": "Microsoft.Compute/virtualMachines/extensions",
-                      "apiVersion": "2022-11-01",
-                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "publisher": "[parameters('publisher')]",
-                        "type": "[parameters('type')]",
-                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
-                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
-                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
-                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
-                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
-                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
-                        "suppressFailures": "[parameters('supressFailures')]"
-                      }
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the extension."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the extension."
-                      },
-                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the Resource Group the extension was created in."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('extension', '2022-11-01', 'full').location]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "vm",
-                "vm_desiredStateConfigurationExtension"
-              ]
-            },
-            "vm_azureDiskEncryptionExtension": {
-              "condition": "[parameters('extensionAzureDiskEncryptionConfig').enabled]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-VM-AzureDiskEncryption', uniqueString(deployment().name, parameters('location')))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "virtualMachineName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "AzureDiskEncryption"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "publisher": {
-                    "value": "Microsoft.Azure.Security"
-                  },
-                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AzureDiskEncryption'), createObject('value', 'AzureDiskEncryptionForLinux'))]",
-                  "typeHandlerVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'typeHandlerVersion'), if(equals(parameters('osType'), 'Windows'), '2.2', '1.1'))]"
-                  },
-                  "autoUpgradeMinorVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'autoUpgradeMinorVersion'), true())]"
-                  },
-                  "enableAutomaticUpgrade": {
-                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'enableAutomaticUpgrade'), false())]"
-                  },
-                  "forceUpdateTag": {
-                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'forceUpdateTag'), '1.0')]"
-                  },
-                  "settings": {
-                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'settings'), createObject())]"
-                  },
-                  "supressFailures": {
-                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'supressFailures'), false())]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'tags'), parameters('tags'))]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "8482591295619883067"
-                    },
-                    "name": "Virtual Machine Extensions",
-                    "description": "This module deploys a Virtual Machine Extension."
-                  },
-                  "parameters": {
-                    "virtualMachineName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the virtual machine extension."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. The location the extension is deployed to."
-                      }
-                    },
-                    "publisher": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the extension handler publisher."
-                      }
-                    },
-                    "type": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
-                      }
-                    },
-                    "typeHandlerVersion": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the version of the script handler."
-                      }
-                    },
-                    "autoUpgradeMinorVersion": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
-                      }
-                    },
-                    "forceUpdateTag": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
-                      }
-                    },
-                    "settings": {
-                      "type": "object",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific settings."
-                      }
-                    },
-                    "protectedSettings": {
-                      "type": "secureObject",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific protected settings."
-                      }
-                    },
-                    "supressFailures": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
-                      }
-                    },
-                    "enableAutomaticUpgrade": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the resource."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "virtualMachine": {
-                      "existing": true,
-                      "type": "Microsoft.Compute/virtualMachines",
-                      "apiVersion": "2022-11-01",
-                      "name": "[parameters('virtualMachineName')]"
-                    },
-                    "extension": {
-                      "type": "Microsoft.Compute/virtualMachines/extensions",
-                      "apiVersion": "2022-11-01",
-                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "publisher": "[parameters('publisher')]",
-                        "type": "[parameters('type')]",
-                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
-                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
-                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
-                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
-                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
-                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
-                        "suppressFailures": "[parameters('supressFailures')]"
-                      }
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the extension."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the extension."
-                      },
-                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the Resource Group the extension was created in."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('extension', '2022-11-01', 'full').location]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "vm",
-                "vm_customScriptExtension"
-              ]
-            },
-            "vm_nvidiaGpuDriverWindowsExtension": {
-              "condition": "[parameters('extensionNvidiaGpuDriverWindows').enabled]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-VM-NvidiaGpuDriverWindows', uniqueString(deployment().name, parameters('location')))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "virtualMachineName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "NvidiaGpuDriverWindows"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "publisher": {
-                    "value": "Microsoft.HpcCompute"
-                  },
-                  "type": {
-                    "value": "NvidiaGpuDriverWindows"
-                  },
-                  "typeHandlerVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'typeHandlerVersion'), '1.4')]"
-                  },
-                  "autoUpgradeMinorVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'autoUpgradeMinorVersion'), true())]"
-                  },
-                  "enableAutomaticUpgrade": {
-                    "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'enableAutomaticUpgrade'), false())]"
-                  },
-                  "supressFailures": {
-                    "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'supressFailures'), false())]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'tags'), parameters('tags'))]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "8482591295619883067"
-                    },
-                    "name": "Virtual Machine Extensions",
-                    "description": "This module deploys a Virtual Machine Extension."
-                  },
-                  "parameters": {
-                    "virtualMachineName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the virtual machine extension."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. The location the extension is deployed to."
-                      }
-                    },
-                    "publisher": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the extension handler publisher."
-                      }
-                    },
-                    "type": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
-                      }
-                    },
-                    "typeHandlerVersion": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the version of the script handler."
-                      }
-                    },
-                    "autoUpgradeMinorVersion": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
-                      }
-                    },
-                    "forceUpdateTag": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
-                      }
-                    },
-                    "settings": {
-                      "type": "object",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific settings."
-                      }
-                    },
-                    "protectedSettings": {
-                      "type": "secureObject",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific protected settings."
-                      }
-                    },
-                    "supressFailures": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
-                      }
-                    },
-                    "enableAutomaticUpgrade": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the resource."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "virtualMachine": {
-                      "existing": true,
-                      "type": "Microsoft.Compute/virtualMachines",
-                      "apiVersion": "2022-11-01",
-                      "name": "[parameters('virtualMachineName')]"
-                    },
-                    "extension": {
-                      "type": "Microsoft.Compute/virtualMachines/extensions",
-                      "apiVersion": "2022-11-01",
-                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "publisher": "[parameters('publisher')]",
-                        "type": "[parameters('type')]",
-                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
-                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
-                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
-                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
-                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
-                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
-                        "suppressFailures": "[parameters('supressFailures')]"
-                      }
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the extension."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the extension."
-                      },
-                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the Resource Group the extension was created in."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('extension', '2022-11-01', 'full').location]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "vm",
-                "vm_azureDiskEncryptionExtension"
-              ]
-            },
-            "vm_hostPoolRegistrationExtension": {
-              "condition": "[parameters('extensionHostPoolRegistration').enabled]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-VM-HostPoolRegistration', uniqueString(deployment().name, parameters('location')))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "virtualMachineName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "HostPoolRegistration"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "publisher": {
-                    "value": "Microsoft.PowerShell"
-                  },
-                  "type": {
-                    "value": "DSC"
-                  },
-                  "typeHandlerVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'typeHandlerVersion'), '2.77')]"
-                  },
-                  "autoUpgradeMinorVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'autoUpgradeMinorVersion'), true())]"
-                  },
-                  "enableAutomaticUpgrade": {
-                    "value": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'enableAutomaticUpgrade'), false())]"
-                  },
-                  "settings": {
-                    "value": {
-                      "modulesUrl": "[parameters('extensionHostPoolRegistration').modulesUrl]",
-                      "configurationFunction": "[parameters('extensionHostPoolRegistration').configurationFunction]",
-                      "properties": {
-                        "hostPoolName": "[parameters('extensionHostPoolRegistration').hostPoolName]",
-                        "registrationInfoToken": "[parameters('extensionHostPoolRegistration').registrationInfoToken]",
-                        "aadJoin": true
-                      },
-                      "supressFailures": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'supressFailures'), false())]"
-                    }
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'tags'), parameters('tags'))]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "8482591295619883067"
-                    },
-                    "name": "Virtual Machine Extensions",
-                    "description": "This module deploys a Virtual Machine Extension."
-                  },
-                  "parameters": {
-                    "virtualMachineName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the virtual machine extension."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. The location the extension is deployed to."
-                      }
-                    },
-                    "publisher": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the extension handler publisher."
-                      }
-                    },
-                    "type": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
-                      }
-                    },
-                    "typeHandlerVersion": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the version of the script handler."
-                      }
-                    },
-                    "autoUpgradeMinorVersion": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
-                      }
-                    },
-                    "forceUpdateTag": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
-                      }
-                    },
-                    "settings": {
-                      "type": "object",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific settings."
-                      }
-                    },
-                    "protectedSettings": {
-                      "type": "secureObject",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific protected settings."
-                      }
-                    },
-                    "supressFailures": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
-                      }
-                    },
-                    "enableAutomaticUpgrade": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the resource."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "virtualMachine": {
-                      "existing": true,
-                      "type": "Microsoft.Compute/virtualMachines",
-                      "apiVersion": "2022-11-01",
-                      "name": "[parameters('virtualMachineName')]"
-                    },
-                    "extension": {
-                      "type": "Microsoft.Compute/virtualMachines/extensions",
-                      "apiVersion": "2022-11-01",
-                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "publisher": "[parameters('publisher')]",
-                        "type": "[parameters('type')]",
-                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
-                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
-                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
-                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
-                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
-                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
-                        "suppressFailures": "[parameters('supressFailures')]"
-                      }
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the extension."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the extension."
-                      },
-                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the Resource Group the extension was created in."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('extension', '2022-11-01', 'full').location]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "vm",
-                "vm_nvidiaGpuDriverWindowsExtension"
-              ]
-            },
-            "vm_azureGuestConfigurationExtension": {
-              "condition": "[parameters('extensionGuestConfigurationExtension').enabled]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-VM-GuestConfiguration', uniqueString(deployment().name, parameters('location')))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "virtualMachineName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AzurePolicyforWindows'), createObject('value', 'AzurePolicyforLinux'))]",
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "publisher": {
-                    "value": "Microsoft.GuestConfiguration"
-                  },
-                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'ConfigurationforWindows'), createObject('value', 'ConfigurationForLinux'))]",
-                  "typeHandlerVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'typeHandlerVersion'), if(equals(parameters('osType'), 'Windows'), '1.0', '1.0'))]"
-                  },
-                  "autoUpgradeMinorVersion": {
-                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'autoUpgradeMinorVersion'), true())]"
-                  },
-                  "enableAutomaticUpgrade": {
-                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'enableAutomaticUpgrade'), true())]"
-                  },
-                  "forceUpdateTag": {
-                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'forceUpdateTag'), '1.0')]"
-                  },
-                  "settings": {
-                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'settings'), createObject())]"
-                  },
-                  "supressFailures": {
-                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'supressFailures'), false())]"
-                  },
-                  "protectedSettings": {
-                    "value": "[parameters('extensionGuestConfigurationExtensionProtectedSettings')]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'tags'), parameters('tags'))]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "8482591295619883067"
-                    },
-                    "name": "Virtual Machine Extensions",
-                    "description": "This module deploys a Virtual Machine Extension."
-                  },
-                  "parameters": {
-                    "virtualMachineName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the virtual machine extension."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. The location the extension is deployed to."
-                      }
-                    },
-                    "publisher": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the extension handler publisher."
-                      }
-                    },
-                    "type": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
-                      }
-                    },
-                    "typeHandlerVersion": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Specifies the version of the script handler."
-                      }
-                    },
-                    "autoUpgradeMinorVersion": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
-                      }
-                    },
-                    "forceUpdateTag": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
-                      }
-                    },
-                    "settings": {
-                      "type": "object",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific settings."
-                      }
-                    },
-                    "protectedSettings": {
-                      "type": "secureObject",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Any object that contains the extension specific protected settings."
-                      }
-                    },
-                    "supressFailures": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
-                      }
-                    },
-                    "enableAutomaticUpgrade": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the resource."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "virtualMachine": {
-                      "existing": true,
-                      "type": "Microsoft.Compute/virtualMachines",
-                      "apiVersion": "2022-11-01",
-                      "name": "[parameters('virtualMachineName')]"
-                    },
-                    "extension": {
-                      "type": "Microsoft.Compute/virtualMachines/extensions",
-                      "apiVersion": "2022-11-01",
-                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "publisher": "[parameters('publisher')]",
-                        "type": "[parameters('type')]",
-                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
-                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
-                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
-                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
-                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
-                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
-                        "suppressFailures": "[parameters('supressFailures')]"
-                      }
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the extension."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the extension."
-                      },
-                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the Resource Group the extension was created in."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('extension', '2022-11-01', 'full').location]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "vm",
-                "vm_hostPoolRegistrationExtension"
-              ]
-            },
-            "vm_backup": {
-              "condition": "[not(empty(parameters('backupVaultName')))]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-VM-Backup', uniqueString(deployment().name, parameters('location')))]",
-              "resourceGroup": "[parameters('backupVaultResourceGroup')]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[format('vm;iaasvmcontainerv2;{0};{1}', resourceGroup().name, parameters('name'))]"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "policyId": {
-                    "value": "[resourceId('Microsoft.RecoveryServices/vaults/backupPolicies', parameters('backupVaultName'), parameters('backupPolicyName'))]"
-                  },
-                  "protectedItemType": {
-                    "value": "Microsoft.Compute/virtualMachines"
-                  },
-                  "protectionContainerName": {
-                    "value": "[format('iaasvmcontainer;iaasvmcontainerv2;{0};{1}', resourceGroup().name, parameters('name'))]"
-                  },
-                  "recoveryVaultName": {
-                    "value": "[parameters('backupVaultName')]"
-                  },
-                  "sourceResourceId": {
-                    "value": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "7743264001610407207"
-                    },
-                    "name": "Recovery Service Vaults Protection Container Protected Item",
-                    "description": "This module deploys a Recovery Services Vault Protection Container Protected Item."
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the resource."
-                      }
-                    },
-                    "protectionContainerName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. Name of the Azure Recovery Service Vault Protection Container. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "recoveryVaultName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Azure Recovery Service Vault. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all resources."
-                      }
-                    },
-                    "protectedItemType": {
-                      "type": "string",
-                      "allowedValues": [
-                        "AzureFileShareProtectedItem",
-                        "AzureVmWorkloadSAPAseDatabase",
-                        "AzureVmWorkloadSAPHanaDatabase",
-                        "AzureVmWorkloadSQLDatabase",
-                        "DPMProtectedItem",
-                        "GenericProtectedItem",
-                        "MabFileFolderProtectedItem",
-                        "Microsoft.ClassicCompute/virtualMachines",
-                        "Microsoft.Compute/virtualMachines",
-                        "Microsoft.Sql/servers/databases"
-                      ],
-                      "metadata": {
-                        "description": "Required. The backup item type."
-                      }
-                    },
-                    "policyId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. ID of the backup policy with which this item is backed up."
-                      }
-                    },
-                    "sourceResourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Resource ID of the resource to back up."
-                      }
-                    }
-                  },
-                  "resources": [
-                    {
-                      "type": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems",
-                      "apiVersion": "2023-01-01",
-                      "name": "[format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name'))]",
-                      "location": "[parameters('location')]",
-                      "properties": {
-                        "protectedItemType": "[parameters('protectedItemType')]",
-                        "policyId": "[parameters('policyId')]",
-                        "sourceResourceId": "[parameters('sourceResourceId')]"
-                      }
-                    }
-                  ],
-                  "outputs": {
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the Resource Group the protected item was created in."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the protected item."
-                      },
-                      "value": "[resourceId('Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems', split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[0], split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[1], split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[2], split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[3])]"
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The Name of the protected item."
-                      },
-                      "value": "[format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name'))]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "vm",
-                "vm_azureGuestConfigurationExtension"
-              ]
-            }
-          },
-          "outputs": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the VM."
-              },
-              "value": "[parameters('name')]"
-            },
-            "resourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource ID of the VM."
-              },
-              "value": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
-            },
-            "resourceGroupName": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the resource group the VM was created in."
-              },
-              "value": "[resourceGroup().name]"
-            },
-            "systemAssignedMIPrincipalId": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "The principal ID of the system assigned identity."
-              },
-              "value": "[tryGet(tryGet(reference('vm', '2024-07-01', 'full'), 'identity'), 'principalId')]"
-            },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "The location the resource was deployed into."
-              },
-              "value": "[reference('vm', '2024-07-01', 'full').location]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "logAnalyticsWorkspace",
-        "virtualNetwork"
-      ]
-    },
-    "privateDnsZonesAiServices": {
-      "copy": {
-        "name": "privateDnsZonesAiServices",
-        "count": "[length(objectKeys(variables('openAiPrivateDnsZones')))]"
-      },
-      "condition": "[and(variables('virtualNetworkEnabled'), variables('aiFoundryAIservicesEnabled'))]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2022-09-01",
-      "name": "[take(format('avm.res.network.private-dns-zone.ai-services.{0}.{1}', uniqueString(variables('aiFoundryAiServicesResourceName'), objectKeys(variables('openAiPrivateDnsZones'))[copyIndex()]), parameters('solutionPrefix')), 64)]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[objectKeys(variables('openAiPrivateDnsZones'))[copyIndex()]]"
-          },
-          "tags": {
-            "value": "[parameters('tags')]"
-          },
-          "enableTelemetry": {
-            "value": "[parameters('enableTelemetry')]"
-          },
-          "virtualNetworkLinks": {
-            "value": [
-              {
-                "name": "[format('vnetlink-{0}', split(objectKeys(variables('openAiPrivateDnsZones'))[copyIndex()], '.')[1])]",
-                "virtualNetworkResourceId": "[reference('virtualNetwork').outputs.resourceId.value]"
-              }
-            ]
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.34.44.8038",
-              "templateHash": "4533956061065498344"
-            },
-            "name": "Private DNS Zones",
-            "description": "This module deploys a Private DNS zone."
-          },
-          "definitions": {
-            "aType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the record."
-                  }
-                },
-                "metadata": {
-                  "type": "object",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The metadata of the record."
-                  }
-                },
-                "ttl": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The TTL of the record."
-                  }
-                },
-                "roleAssignments": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/roleAssignmentType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Array of role assignments to create."
-                  }
-                },
-                "aRecords": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "ipv4Address": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. The IPv4 address of this A record."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The list of A records in the record set."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for the A record."
-              }
-            },
-            "aaaaType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the record."
-                  }
-                },
-                "metadata": {
-                  "type": "object",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The metadata of the record."
-                  }
-                },
-                "ttl": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The TTL of the record."
-                  }
-                },
-                "roleAssignments": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/roleAssignmentType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Array of role assignments to create."
-                  }
-                },
-                "aaaaRecords": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "ipv6Address": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. The IPv6 address of this AAAA record."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The list of AAAA records in the record set."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for the AAAA record."
-              }
-            },
-            "cnameType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the record."
-                  }
-                },
-                "metadata": {
-                  "type": "object",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The metadata of the record."
-                  }
-                },
-                "ttl": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The TTL of the record."
-                  }
-                },
-                "roleAssignments": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/roleAssignmentType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Array of role assignments to create."
-                  }
-                },
-                "cnameRecord": {
-                  "type": "object",
-                  "properties": {
-                    "cname": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The canonical name of the CNAME record."
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The CNAME record in the record set."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for the CNAME record."
-              }
-            },
-            "mxType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the record."
-                  }
-                },
-                "metadata": {
-                  "type": "object",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The metadata of the record."
-                  }
-                },
-                "ttl": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The TTL of the record."
-                  }
-                },
-                "roleAssignments": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/roleAssignmentType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Array of role assignments to create."
-                  }
-                },
-                "mxRecords": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "exchange": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. The domain name of the mail host for this MX record."
-                        }
-                      },
-                      "preference": {
-                        "type": "int",
-                        "metadata": {
-                          "description": "Required. The preference value for this MX record."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The list of MX records in the record set."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for the MX record."
-              }
-            },
-            "ptrType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the record."
-                  }
-                },
-                "metadata": {
-                  "type": "object",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The metadata of the record."
-                  }
-                },
-                "ttl": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The TTL of the record."
-                  }
-                },
-                "roleAssignments": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/roleAssignmentType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Array of role assignments to create."
-                  }
-                },
-                "ptrRecords": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "ptrdname": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. The PTR target domain name for this PTR record."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The list of PTR records in the record set."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for the PTR record."
-              }
-            },
-            "soaType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the record."
-                  }
-                },
-                "metadata": {
-                  "type": "object",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The metadata of the record."
-                  }
-                },
-                "ttl": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The TTL of the record."
-                  }
-                },
-                "roleAssignments": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/roleAssignmentType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Array of role assignments to create."
-                  }
-                },
-                "soaRecord": {
-                  "type": "object",
-                  "properties": {
-                    "email": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The email contact for this SOA record."
-                      }
-                    },
-                    "expireTime": {
-                      "type": "int",
-                      "metadata": {
-                        "description": "Required. The expire time for this SOA record."
-                      }
-                    },
-                    "host": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The domain name of the authoritative name server for this SOA record."
-                      }
-                    },
-                    "minimumTtl": {
-                      "type": "int",
-                      "metadata": {
-                        "description": "Required. The minimum value for this SOA record. By convention this is used to determine the negative caching duration."
-                      }
-                    },
-                    "refreshTime": {
-                      "type": "int",
-                      "metadata": {
-                        "description": "Required. The refresh value for this SOA record."
-                      }
-                    },
-                    "retryTime": {
-                      "type": "int",
-                      "metadata": {
-                        "description": "Required. The retry time for this SOA record."
-                      }
-                    },
-                    "serialNumber": {
-                      "type": "int",
-                      "metadata": {
-                        "description": "Required. The serial number for this SOA record."
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The SOA record in the record set."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for the SOA record."
-              }
-            },
-            "srvType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the record."
-                  }
-                },
-                "metadata": {
-                  "type": "object",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The metadata of the record."
-                  }
-                },
-                "ttl": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The TTL of the record."
-                  }
-                },
-                "roleAssignments": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/roleAssignmentType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Array of role assignments to create."
-                  }
-                },
-                "srvRecords": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "priority": {
-                        "type": "int",
-                        "metadata": {
-                          "description": "Required. The priority value for this SRV record."
-                        }
-                      },
-                      "weight": {
-                        "type": "int",
-                        "metadata": {
-                          "description": "Required. The weight value for this SRV record."
-                        }
-                      },
-                      "port": {
-                        "type": "int",
-                        "metadata": {
-                          "description": "Required. The port value for this SRV record."
-                        }
-                      },
-                      "target": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. The target domain name for this SRV record."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The list of SRV records in the record set."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for the SRV record."
-              }
-            },
-            "txtType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the record."
-                  }
-                },
-                "metadata": {
-                  "type": "object",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The metadata of the record."
-                  }
-                },
-                "ttl": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The TTL of the record."
-                  }
-                },
-                "roleAssignments": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/roleAssignmentType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Array of role assignments to create."
-                  }
-                },
-                "txtRecords": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "value": {
-                        "type": "array",
-                        "items": {
-                          "type": "string"
-                        },
-                        "metadata": {
-                          "description": "Required. The text value of this TXT record."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The list of TXT records in the record set."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for the TXT record."
-              }
-            },
-            "virtualNetworkLinkType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "minLength": 1,
-                  "maxLength": 80,
-                  "metadata": {
-                    "description": "Optional. The resource name."
-                  }
-                },
-                "virtualNetworkResourceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The resource ID of the virtual network to link."
-                  }
-                },
-                "location": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The Azure Region where the resource lives."
-                  }
-                },
-                "registrationEnabled": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Is auto-registration of virtual machine records in the virtual network in the Private DNS zone enabled?."
-                  }
-                },
-                "tags": {
-                  "type": "object",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource tags."
-                  }
-                },
-                "resolutionPolicy": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Default",
-                    "NxDomainRedirect"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resolution type of the private-dns-zone fallback machanism."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for the virtual network link."
-              }
-            },
-            "lockType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of lock."
-                  }
-                },
-                "kind": {
-                  "type": "string",
-                  "allowedValues": [
-                    "CanNotDelete",
-                    "None",
-                    "ReadOnly"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a lock.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "roleAssignmentType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                  }
-                },
-                "roleDefinitionIdOrName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                  }
-                },
-                "principalId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                  }
-                },
-                "principalType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Device",
-                    "ForeignGroup",
-                    "Group",
-                    "ServicePrincipal",
-                    "User"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The principal type of the assigned principal ID."
-                  }
-                },
-                "description": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The description of the role assignment."
-                  }
-                },
-                "condition": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                  }
-                },
-                "conditionVersion": {
-                  "type": "string",
-                  "allowedValues": [
-                    "2.0"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Version of the condition."
-                  }
-                },
-                "delegatedManagedIdentityResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a role assignment.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. Private DNS zone name."
-              }
-            },
-            "a": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/aType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of A records."
-              }
-            },
-            "aaaa": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/aaaaType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of AAAA records."
-              }
-            },
-            "cname": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/cnameType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of CNAME records."
-              }
-            },
-            "mx": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/mxType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of MX records."
-              }
-            },
-            "ptr": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/ptrType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of PTR records."
-              }
-            },
-            "soa": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/soaType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of SOA records."
-              }
-            },
-            "srv": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/srvType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of SRV records."
-              }
-            },
-            "txt": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/txtType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of TXT records."
-              }
-            },
-            "virtualNetworkLinks": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/virtualNetworkLinkType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of custom objects describing vNet links of the DNS zone. Each object should contain properties 'virtualNetworkResourceId' and 'registrationEnabled'. The 'vnetResourceId' is a resource ID of a vNet to link, 'registrationEnabled' (bool) enables automatic DNS registration in the zone for the linked vNet."
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "global",
-              "metadata": {
-                "description": "Optional. The location of the PrivateDNSZone. Should be global."
-              }
-            },
-            "roleAssignments": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/roleAssignmentType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of role assignments to create."
-              }
-            },
-            "tags": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Tags of the resource."
-              }
-            },
-            "lock": {
-              "$ref": "#/definitions/lockType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The lock settings of the service."
-              }
-            },
-            "enableTelemetry": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Enable/Disable usage telemetry for module."
-              }
-            }
-          },
-          "variables": {
-            "copy": [
-              {
-                "name": "formattedRoleAssignments",
-                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-              }
-            ],
-            "builtInRoleNames": {
-              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
-            }
-          },
-          "resources": {
-            "avmTelemetry": {
-              "condition": "[parameters('enableTelemetry')]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privatednszone.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-              "properties": {
-                "mode": "Incremental",
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "resources": [],
-                  "outputs": {
-                    "telemetry": {
-                      "type": "String",
-                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                    }
-                  }
-                }
-              }
-            },
-            "privateDnsZone": {
-              "type": "Microsoft.Network/privateDnsZones",
-              "apiVersion": "2020-06-01",
-              "name": "[parameters('name')]",
-              "location": "[parameters('location')]",
-              "tags": "[parameters('tags')]"
-            },
-            "privateDnsZone_lock": {
-              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-              "type": "Microsoft.Authorization/locks",
-              "apiVersion": "2020-05-01",
-              "scope": "[format('Microsoft.Network/privateDnsZones/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-              "properties": {
-                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-              },
-              "dependsOn": [
-                "privateDnsZone"
-              ]
-            },
-            "privateDnsZone_roleAssignments": {
-              "copy": {
-                "name": "privateDnsZone_roleAssignments",
-                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-              },
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[format('Microsoft.Network/privateDnsZones/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-              "properties": {
-                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-              },
-              "dependsOn": [
-                "privateDnsZone"
-              ]
-            },
-            "privateDnsZone_A": {
-              "copy": {
-                "name": "privateDnsZone_A",
-                "count": "[length(coalesce(parameters('a'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-PrivateDnsZone-ARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "privateDnsZoneName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(parameters('a'), createArray())[copyIndex()].name]"
-                  },
-                  "aRecords": {
-                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'aRecords')]"
-                  },
-                  "metadata": {
-                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'metadata')]"
-                  },
-                  "ttl": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'ttl'), 3600)]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'roleAssignments')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "18243374258187942664"
-                    },
-                    "name": "Private DNS Zone A record",
-                    "description": "This module deploys a Private DNS Zone A record."
-                  },
-                  "definitions": {
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "privateDnsZoneName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the A record."
-                      }
-                    },
-                    "aRecords": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The list of A records in the record set."
-                      }
-                    },
-                    "metadata": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The metadata attached to the record set."
-                      }
-                    },
-                    "ttl": {
-                      "type": "int",
-                      "defaultValue": 3600,
-                      "metadata": {
-                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "privateDnsZone": {
-                      "existing": true,
-                      "type": "Microsoft.Network/privateDnsZones",
-                      "apiVersion": "2020-06-01",
-                      "name": "[parameters('privateDnsZoneName')]"
-                    },
-                    "A": {
-                      "type": "Microsoft.Network/privateDnsZones/A",
-                      "apiVersion": "2020-06-01",
-                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "properties": {
-                        "aRecords": "[parameters('aRecords')]",
-                        "metadata": "[parameters('metadata')]",
-                        "ttl": "[parameters('ttl')]"
-                      }
-                    },
-                    "A_roleAssignments": {
-                      "copy": {
-                        "name": "A_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/A/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "A"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed A record."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed A record."
-                      },
-                      "value": "[resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group of the deployed A record."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "privateDnsZone"
-              ]
-            },
-            "privateDnsZone_AAAA": {
-              "copy": {
-                "name": "privateDnsZone_AAAA",
-                "count": "[length(coalesce(parameters('aaaa'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-PrivateDnsZone-AAAARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "privateDnsZoneName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(parameters('aaaa'), createArray())[copyIndex()].name]"
-                  },
-                  "aaaaRecords": {
-                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'aaaaRecords')]"
-                  },
-                  "metadata": {
-                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'metadata')]"
-                  },
-                  "ttl": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'ttl'), 3600)]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'roleAssignments')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "7322684246075092047"
-                    },
-                    "name": "Private DNS Zone AAAA record",
-                    "description": "This module deploys a Private DNS Zone AAAA record."
-                  },
-                  "definitions": {
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "privateDnsZoneName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the AAAA record."
-                      }
-                    },
-                    "aaaaRecords": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The list of AAAA records in the record set."
-                      }
-                    },
-                    "metadata": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The metadata attached to the record set."
-                      }
-                    },
-                    "ttl": {
-                      "type": "int",
-                      "defaultValue": 3600,
-                      "metadata": {
-                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "privateDnsZone": {
-                      "existing": true,
-                      "type": "Microsoft.Network/privateDnsZones",
-                      "apiVersion": "2020-06-01",
-                      "name": "[parameters('privateDnsZoneName')]"
-                    },
-                    "AAAA": {
-                      "type": "Microsoft.Network/privateDnsZones/AAAA",
-                      "apiVersion": "2020-06-01",
-                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "properties": {
-                        "aaaaRecords": "[parameters('aaaaRecords')]",
-                        "metadata": "[parameters('metadata')]",
-                        "ttl": "[parameters('ttl')]"
-                      }
-                    },
-                    "AAAA_roleAssignments": {
-                      "copy": {
-                        "name": "AAAA_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/AAAA/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "AAAA"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed AAAA record."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed AAAA record."
-                      },
-                      "value": "[resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group of the deployed AAAA record."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "privateDnsZone"
-              ]
-            },
-            "privateDnsZone_CNAME": {
-              "copy": {
-                "name": "privateDnsZone_CNAME",
-                "count": "[length(coalesce(parameters('cname'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-PrivateDnsZone-CNAMERecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "privateDnsZoneName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(parameters('cname'), createArray())[copyIndex()].name]"
-                  },
-                  "cnameRecord": {
-                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'cnameRecord')]"
-                  },
-                  "metadata": {
-                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'metadata')]"
-                  },
-                  "ttl": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'ttl'), 3600)]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'roleAssignments')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "5264706240021075859"
-                    },
-                    "name": "Private DNS Zone CNAME record",
-                    "description": "This module deploys a Private DNS Zone CNAME record."
-                  },
-                  "definitions": {
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "privateDnsZoneName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the CNAME record."
-                      }
-                    },
-                    "cnameRecord": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. A CNAME record."
-                      }
-                    },
-                    "metadata": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The metadata attached to the record set."
-                      }
-                    },
-                    "ttl": {
-                      "type": "int",
-                      "defaultValue": 3600,
-                      "metadata": {
-                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "privateDnsZone": {
-                      "existing": true,
-                      "type": "Microsoft.Network/privateDnsZones",
-                      "apiVersion": "2020-06-01",
-                      "name": "[parameters('privateDnsZoneName')]"
-                    },
-                    "CNAME": {
-                      "type": "Microsoft.Network/privateDnsZones/CNAME",
-                      "apiVersion": "2020-06-01",
-                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "properties": {
-                        "cnameRecord": "[parameters('cnameRecord')]",
-                        "metadata": "[parameters('metadata')]",
-                        "ttl": "[parameters('ttl')]"
-                      }
-                    },
-                    "CNAME_roleAssignments": {
-                      "copy": {
-                        "name": "CNAME_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/CNAME/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "CNAME"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed CNAME record."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed CNAME record."
-                      },
-                      "value": "[resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group of the deployed CNAME record."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "privateDnsZone"
-              ]
-            },
-            "privateDnsZone_MX": {
-              "copy": {
-                "name": "privateDnsZone_MX",
-                "count": "[length(coalesce(parameters('mx'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-PrivateDnsZone-MXRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "privateDnsZoneName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(parameters('mx'), createArray())[copyIndex()].name]"
-                  },
-                  "metadata": {
-                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'metadata')]"
-                  },
-                  "mxRecords": {
-                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'mxRecords')]"
-                  },
-                  "ttl": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'ttl'), 3600)]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'roleAssignments')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "13758189936483275969"
-                    },
-                    "name": "Private DNS Zone MX record",
-                    "description": "This module deploys a Private DNS Zone MX record."
-                  },
-                  "definitions": {
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "privateDnsZoneName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the MX record."
-                      }
-                    },
-                    "metadata": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The metadata attached to the record set."
-                      }
-                    },
-                    "mxRecords": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The list of MX records in the record set."
-                      }
-                    },
-                    "ttl": {
-                      "type": "int",
-                      "defaultValue": 3600,
-                      "metadata": {
-                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "privateDnsZone": {
-                      "existing": true,
-                      "type": "Microsoft.Network/privateDnsZones",
-                      "apiVersion": "2020-06-01",
-                      "name": "[parameters('privateDnsZoneName')]"
-                    },
-                    "MX": {
-                      "type": "Microsoft.Network/privateDnsZones/MX",
-                      "apiVersion": "2020-06-01",
-                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "properties": {
-                        "metadata": "[parameters('metadata')]",
-                        "mxRecords": "[parameters('mxRecords')]",
-                        "ttl": "[parameters('ttl')]"
-                      }
-                    },
-                    "MX_roleAssignments": {
-                      "copy": {
-                        "name": "MX_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/MX/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "MX"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed MX record."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed MX record."
-                      },
-                      "value": "[resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group of the deployed MX record."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "privateDnsZone"
-              ]
-            },
-            "privateDnsZone_PTR": {
-              "copy": {
-                "name": "privateDnsZone_PTR",
-                "count": "[length(coalesce(parameters('ptr'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-PrivateDnsZone-PTRRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "privateDnsZoneName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(parameters('ptr'), createArray())[copyIndex()].name]"
-                  },
-                  "metadata": {
-                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'metadata')]"
-                  },
-                  "ptrRecords": {
-                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'ptrRecords')]"
-                  },
-                  "ttl": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'ttl'), 3600)]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'roleAssignments')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "11955164584650609753"
-                    },
-                    "name": "Private DNS Zone PTR record",
-                    "description": "This module deploys a Private DNS Zone PTR record."
-                  },
-                  "definitions": {
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "privateDnsZoneName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the PTR record."
-                      }
-                    },
-                    "metadata": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The metadata attached to the record set."
-                      }
-                    },
-                    "ptrRecords": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The list of PTR records in the record set."
-                      }
-                    },
-                    "ttl": {
-                      "type": "int",
-                      "defaultValue": 3600,
-                      "metadata": {
-                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "privateDnsZone": {
-                      "existing": true,
-                      "type": "Microsoft.Network/privateDnsZones",
-                      "apiVersion": "2020-06-01",
-                      "name": "[parameters('privateDnsZoneName')]"
-                    },
-                    "PTR": {
-                      "type": "Microsoft.Network/privateDnsZones/PTR",
-                      "apiVersion": "2020-06-01",
-                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "properties": {
-                        "metadata": "[parameters('metadata')]",
-                        "ptrRecords": "[parameters('ptrRecords')]",
-                        "ttl": "[parameters('ttl')]"
-                      }
-                    },
-                    "PTR_roleAssignments": {
-                      "copy": {
-                        "name": "PTR_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/PTR/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "PTR"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed PTR record."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed PTR record."
-                      },
-                      "value": "[resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group of the deployed PTR record."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "privateDnsZone"
-              ]
-            },
-            "privateDnsZone_SOA": {
-              "copy": {
-                "name": "privateDnsZone_SOA",
-                "count": "[length(coalesce(parameters('soa'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-PrivateDnsZone-SOARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "privateDnsZoneName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(parameters('soa'), createArray())[copyIndex()].name]"
-                  },
-                  "metadata": {
-                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'metadata')]"
-                  },
-                  "soaRecord": {
-                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'soaRecord')]"
-                  },
-                  "ttl": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'ttl'), 3600)]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'roleAssignments')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "14626715835033259725"
-                    },
-                    "name": "Private DNS Zone SOA record",
-                    "description": "This module deploys a Private DNS Zone SOA record."
-                  },
-                  "definitions": {
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "privateDnsZoneName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the SOA record."
-                      }
-                    },
-                    "metadata": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The metadata attached to the record set."
-                      }
-                    },
-                    "soaRecord": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. A SOA record."
-                      }
-                    },
-                    "ttl": {
-                      "type": "int",
-                      "defaultValue": 3600,
-                      "metadata": {
-                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "privateDnsZone": {
-                      "existing": true,
-                      "type": "Microsoft.Network/privateDnsZones",
-                      "apiVersion": "2020-06-01",
-                      "name": "[parameters('privateDnsZoneName')]"
-                    },
-                    "SOA": {
-                      "type": "Microsoft.Network/privateDnsZones/SOA",
-                      "apiVersion": "2020-06-01",
-                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "properties": {
-                        "metadata": "[parameters('metadata')]",
-                        "soaRecord": "[parameters('soaRecord')]",
-                        "ttl": "[parameters('ttl')]"
-                      }
-                    },
-                    "SOA_roleAssignments": {
-                      "copy": {
-                        "name": "SOA_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/SOA/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "SOA"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed SOA record."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed SOA record."
-                      },
-                      "value": "[resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group of the deployed SOA record."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "privateDnsZone"
-              ]
-            },
-            "privateDnsZone_SRV": {
-              "copy": {
-                "name": "privateDnsZone_SRV",
-                "count": "[length(coalesce(parameters('srv'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-PrivateDnsZone-SRVRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "privateDnsZoneName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(parameters('srv'), createArray())[copyIndex()].name]"
-                  },
-                  "metadata": {
-                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'metadata')]"
-                  },
-                  "srvRecords": {
-                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'srvRecords')]"
-                  },
-                  "ttl": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'ttl'), 3600)]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'roleAssignments')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "6510442308165042737"
-                    },
-                    "name": "Private DNS Zone SRV record",
-                    "description": "This module deploys a Private DNS Zone SRV record."
-                  },
-                  "definitions": {
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "privateDnsZoneName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the SRV record."
-                      }
-                    },
-                    "metadata": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The metadata attached to the record set."
-                      }
-                    },
-                    "srvRecords": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The list of SRV records in the record set."
-                      }
-                    },
-                    "ttl": {
-                      "type": "int",
-                      "defaultValue": 3600,
-                      "metadata": {
-                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "privateDnsZone": {
-                      "existing": true,
-                      "type": "Microsoft.Network/privateDnsZones",
-                      "apiVersion": "2020-06-01",
-                      "name": "[parameters('privateDnsZoneName')]"
-                    },
-                    "SRV": {
-                      "type": "Microsoft.Network/privateDnsZones/SRV",
-                      "apiVersion": "2020-06-01",
-                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "properties": {
-                        "metadata": "[parameters('metadata')]",
-                        "srvRecords": "[parameters('srvRecords')]",
-                        "ttl": "[parameters('ttl')]"
-                      }
-                    },
-                    "SRV_roleAssignments": {
-                      "copy": {
-                        "name": "SRV_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/SRV/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "SRV"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed SRV record."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed SRV record."
-                      },
-                      "value": "[resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group of the deployed SRV record."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "privateDnsZone"
-              ]
-            },
-            "privateDnsZone_TXT": {
-              "copy": {
-                "name": "privateDnsZone_TXT",
-                "count": "[length(coalesce(parameters('txt'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-PrivateDnsZone-TXTRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "privateDnsZoneName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(parameters('txt'), createArray())[copyIndex()].name]"
-                  },
-                  "metadata": {
-                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'metadata')]"
-                  },
-                  "txtRecords": {
-                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'txtRecords')]"
-                  },
-                  "ttl": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'ttl'), 3600)]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'roleAssignments')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "170623042781622569"
-                    },
-                    "name": "Private DNS Zone TXT record",
-                    "description": "This module deploys a Private DNS Zone TXT record."
-                  },
-                  "definitions": {
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "privateDnsZoneName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the TXT record."
-                      }
-                    },
-                    "metadata": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The metadata attached to the record set."
-                      }
-                    },
-                    "ttl": {
-                      "type": "int",
-                      "defaultValue": 3600,
-                      "metadata": {
-                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
-                      }
-                    },
-                    "txtRecords": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The list of TXT records in the record set."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "privateDnsZone": {
-                      "existing": true,
-                      "type": "Microsoft.Network/privateDnsZones",
-                      "apiVersion": "2020-06-01",
-                      "name": "[parameters('privateDnsZoneName')]"
-                    },
-                    "TXT": {
-                      "type": "Microsoft.Network/privateDnsZones/TXT",
-                      "apiVersion": "2020-06-01",
-                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "properties": {
-                        "metadata": "[parameters('metadata')]",
-                        "ttl": "[parameters('ttl')]",
-                        "txtRecords": "[parameters('txtRecords')]"
-                      }
-                    },
-                    "TXT_roleAssignments": {
-                      "copy": {
-                        "name": "TXT_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/TXT/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "TXT"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed TXT record."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed TXT record."
-                      },
-                      "value": "[resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group of the deployed TXT record."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "privateDnsZone"
-              ]
-            },
-            "privateDnsZone_virtualNetworkLinks": {
-              "copy": {
-                "name": "privateDnsZone_virtualNetworkLinks",
-                "count": "[length(coalesce(parameters('virtualNetworkLinks'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-PrivateDnsZone-VNetLink-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "privateDnsZoneName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'name'), format('{0}-vnetlink', last(split(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()].virtualNetworkResourceId, '/'))))]"
-                  },
-                  "virtualNetworkResourceId": {
-                    "value": "[coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()].virtualNetworkResourceId]"
-                  },
-                  "location": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'location'), 'global')]"
-                  },
-                  "registrationEnabled": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'registrationEnabled'), false())]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                  },
-                  "resolutionPolicy": {
-                    "value": "[tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'resolutionPolicy')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "725891200086243555"
-                    },
-                    "name": "Private DNS Zone Virtual Network Link",
-                    "description": "This module deploys a Private DNS Zone Virtual Network Link."
-                  },
-                  "parameters": {
-                    "privateDnsZoneName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "defaultValue": "[format('{0}-vnetlink', last(split(parameters('virtualNetworkResourceId'), '/')))]",
-                      "metadata": {
-                        "description": "Optional. The name of the virtual network link."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "global",
-                      "metadata": {
-                        "description": "Optional. The location of the PrivateDNSZone. Should be global."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the resource."
-                      }
-                    },
-                    "registrationEnabled": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Is auto-registration of virtual machine records in the virtual network in the Private DNS zone enabled?."
-                      }
-                    },
-                    "virtualNetworkResourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Link to another virtual network resource ID."
-                      }
-                    },
-                    "resolutionPolicy": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The resolution policy on the virtual network link. Only applicable for virtual network links to privatelink zones, and for A,AAAA,CNAME queries. When set to `NxDomainRedirect`, Azure DNS resolver falls back to public resolution if private dns query resolution results in non-existent domain response. `Default` is configured as the default option."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "privateDnsZone": {
-                      "existing": true,
-                      "type": "Microsoft.Network/privateDnsZones",
-                      "apiVersion": "2020-06-01",
-                      "name": "[parameters('privateDnsZoneName')]"
-                    },
-                    "virtualNetworkLink": {
-                      "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
-                      "apiVersion": "2024-06-01",
-                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "registrationEnabled": "[parameters('registrationEnabled')]",
-                        "virtualNetwork": {
-                          "id": "[parameters('virtualNetworkResourceId')]"
-                        },
-                        "resolutionPolicy": "[parameters('resolutionPolicy')]"
-                      }
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed virtual network link."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed virtual network link."
-                      },
-                      "value": "[resourceId('Microsoft.Network/privateDnsZones/virtualNetworkLinks', parameters('privateDnsZoneName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group of the deployed virtual network link."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('virtualNetworkLink', '2024-06-01', 'full').location]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "privateDnsZone"
-              ]
-            }
-          },
-          "outputs": {
-            "resourceGroupName": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource group the private DNS zone was deployed into."
-              },
-              "value": "[resourceGroup().name]"
-            },
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the private DNS zone."
-              },
-              "value": "[parameters('name')]"
-            },
-            "resourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource ID of the private DNS zone."
-              },
-              "value": "[resourceId('Microsoft.Network/privateDnsZones', parameters('name'))]"
-            },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "The location the resource was deployed into."
-              },
-              "value": "[reference('privateDnsZone', '2020-06-01', 'full').location]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "virtualNetwork"
-      ]
-    },
-    "aiFoundryAiServices": {
-      "condition": "[variables('aiFoundryAIservicesEnabled')]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2022-09-01",
-      "name": "[take(format('avm.res.cognitive-services.account.{0}', variables('aiFoundryAiServicesResourceName')), 64)]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[variables('aiFoundryAiServicesResourceName')]"
-          },
-          "tags": {
-            "value": "[coalesce(tryGet(parameters('aiFoundryAiServicesConfiguration'), 'tags'), parameters('tags'))]"
-          },
-          "location": {
-            "value": "[coalesce(tryGet(parameters('aiFoundryAiServicesConfiguration'), 'location'), parameters('azureOpenAILocation'))]"
-          },
-          "enableTelemetry": {
-            "value": "[parameters('enableTelemetry')]"
-          },
-          "diagnosticSettings": {
-            "value": [
-              {
-                "workspaceResourceId": "[if(variables('useExistingWorkspace'), variables('existingWorkspaceResourceId'), listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId)]"
-              }
-            ]
-          },
-          "sku": {
-            "value": "[coalesce(tryGet(parameters('aiFoundryAiServicesConfiguration'), 'sku'), 'S0')]"
-          },
-          "kind": {
-            "value": "AIServices"
-          },
-          "disableLocalAuth": {
-            "value": false
-          },
-          "customSubDomainName": {
-            "value": "[variables('aiFoundryAiServicesResourceName')]"
-          },
-          "apiProperties": {
-            "value": {}
-          },
-          "allowProjectManagement": {
-            "value": true
-          },
-          "managedIdentities": {
-            "value": {
-              "systemAssigned": true
-            }
-          },
-          "publicNetworkAccess": {
-            "value": "Enabled"
-          },
-          "privateEndpoints": "[if(variables('virtualNetworkEnabled'), createObject('value', createArray(createObject('name', format('pep-{0}', variables('aiFoundryAiServicesResourceName')), 'customNetworkInterfaceName', format('nic-{0}', variables('aiFoundryAiServicesResourceName')), 'subnetResourceId', coalesce(tryGet(parameters('aiFoundryAiServicesConfiguration'), 'subnetResourceId'), reference('virtualNetwork').outputs.subnetResourceIds.value[0]), 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', map(objectKeys(variables('openAiPrivateDnsZones')), lambda('zone', createObject('name', replace(lambdaVariables('zone'), '.', '-'), 'privateDnsZoneResourceId', resourceId('Microsoft.Network/privateDnsZones', lambdaVariables('zone'))))))))), createObject('value', createArray()))]",
-          "deployments": {
-            "value": "[coalesce(tryGet(parameters('aiFoundryAiServicesConfiguration'), 'deployments'), createArray(createObject('name', variables('aiFoundryAiServicesModelDeployment').name, 'model', createObject('format', variables('aiFoundryAiServicesModelDeployment').format, 'name', variables('aiFoundryAiServicesModelDeployment').name, 'version', variables('aiFoundryAiServicesModelDeployment').version), 'raiPolicyName', variables('aiFoundryAiServicesModelDeployment').raiPolicyName, 'sku', createObject('name', variables('aiFoundryAiServicesModelDeployment').sku.name, 'capacity', variables('aiFoundryAiServicesModelDeployment').sku.capacity))))]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.36.1.42791",
-              "templateHash": "16135659971302525380"
-            },
-            "name": "Cognitive Services",
-            "description": "This module deploys a Cognitive Service."
-          },
-          "definitions": {
-            "privateEndpointOutputType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "The name of the private endpoint."
-                  }
-                },
-                "resourceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "The resource ID of the private endpoint."
-                  }
-                },
-                "groupId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "The group Id for the private endpoint Group."
-                  }
-                },
-                "customDnsConfigs": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "fqdn": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "FQDN that resolves to private endpoint IP address."
-                        }
-                      },
-                      "ipAddresses": {
-                        "type": "array",
-                        "items": {
-                          "type": "string"
-                        },
-                        "metadata": {
-                          "description": "A list of private IP addresses of the private endpoint."
-                        }
-                      }
-                    }
-                  },
-                  "metadata": {
-                    "description": "The custom DNS configurations of the private endpoint."
-                  }
-                },
-                "networkInterfaceResourceIds": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "metadata": {
-                    "description": "The IDs of the network interfaces associated with the private endpoint."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for the private endpoint output."
-              }
-            },
-            "deploymentType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of cognitive service account deployment."
-                  }
-                },
-                "model": {
-                  "type": "object",
-                  "properties": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of Cognitive Services account deployment model."
-                      }
-                    },
-                    "format": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The format of Cognitive Services account deployment model."
-                      }
-                    },
-                    "version": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The version of Cognitive Services account deployment model."
-                      }
-                    }
-                  },
-                  "metadata": {
-                    "description": "Required. Properties of Cognitive Services account deployment model."
-                  }
-                },
-                "sku": {
-                  "type": "object",
-                  "properties": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the resource model definition representing SKU."
-                      }
-                    },
-                    "capacity": {
-                      "type": "int",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The capacity of the resource model definition representing SKU."
-                      }
-                    },
-                    "tier": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The tier of the resource model definition representing SKU."
-                      }
-                    },
-                    "size": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The size of the resource model definition representing SKU."
-                      }
-                    },
-                    "family": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The family of the resource model definition representing SKU."
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource model definition representing SKU."
-                  }
-                },
-                "raiPolicyName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of RAI policy."
-                  }
-                },
-                "versionUpgradeOption": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The version upgrade option."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for a cognitive services account deployment."
-              }
-            },
-            "endpointType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Type of the endpoint."
-                  }
-                },
-                "endpoint": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "The endpoint URI."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for a cognitive services account endpoint."
-              }
-            },
-            "secretsExportConfigurationType": {
-              "type": "object",
-              "properties": {
-                "keyVaultResourceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The key vault name where to store the keys and connection strings generated by the modules."
-                  }
-                },
-                "accessKey1Name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name for the accessKey1 secret to create."
-                  }
-                },
-                "accessKey2Name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name for the accessKey2 secret to create."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type of the secrets exported to the provided Key Vault."
-              }
-            },
-            "_1.privateEndpointCustomDnsConfigType": {
-              "type": "object",
-              "properties": {
-                "fqdn": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. FQDN that resolves to private endpoint IP address."
-                  }
-                },
-                "ipAddresses": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "metadata": {
-                    "description": "Required. A list of private IP addresses of the private endpoint."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "_1.privateEndpointIpConfigurationType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the resource that is unique within a resource group."
-                  }
-                },
-                "properties": {
-                  "type": "object",
-                  "properties": {
-                    "groupId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                      }
-                    },
-                    "memberName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
-                      }
-                    },
-                    "privateIPAddress": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                      }
-                    }
-                  },
-                  "metadata": {
-                    "description": "Required. Properties of private endpoint IP configurations."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "_1.privateEndpointPrivateDnsZoneGroupType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the Private DNS Zone Group."
-                  }
-                },
-                "privateDnsZoneGroupConfigs": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "name": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. The name of the private DNS Zone Group config."
-                        }
-                      },
-                      "privateDnsZoneResourceId": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. The resource id of the private DNS zone."
-                        }
-                      }
-                    }
-                  },
-                  "metadata": {
-                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "_1.secretSetOutputType": {
-              "type": "object",
-              "properties": {
-                "secretResourceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "The resourceId of the exported secret."
-                  }
-                },
-                "secretUri": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "The secret URI of the exported secret."
-                  }
-                },
-                "secretUriWithVersion": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "The secret URI with version of the exported secret."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "customerManagedKeyType": {
-              "type": "object",
-              "properties": {
-                "keyVaultResourceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
-                  }
-                },
-                "keyName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the customer managed key to use for encryption."
-                  }
-                },
-                "keyVersion": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, the deployment will use the latest version available at deployment time."
-                  }
-                },
-                "userAssignedIdentityResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type does not support auto-rotation of the customer-managed key.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "diagnosticSettingFullType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the diagnostic setting."
-                  }
-                },
-                "logCategoriesAndGroups": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                        }
-                      },
-                      "categoryGroup": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                        }
-                      },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                  }
-                },
-                "metricCategories": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                        }
-                      },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                  }
-                },
-                "logAnalyticsDestinationType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "AzureDiagnostics",
-                    "Dedicated"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                  }
-                },
-                "workspaceResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "storageAccountResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "eventHubAuthorizationRuleResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                  }
-                },
-                "eventHubName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "marketplacePartnerResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "lockType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of lock."
-                  }
-                },
-                "kind": {
-                  "type": "string",
-                  "allowedValues": [
-                    "CanNotDelete",
-                    "None",
-                    "ReadOnly"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a lock.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "managedIdentityAllType": {
-              "type": "object",
-              "properties": {
-                "systemAssigned": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Enables system assigned managed identity on the resource."
-                  }
-                },
-                "userAssignedResourceIds": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "privateEndpointSingleServiceType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the Private Endpoint."
-                  }
-                },
-                "location": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The location to deploy the Private Endpoint to."
-                  }
-                },
-                "privateLinkServiceConnectionName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the private link connection to create."
-                  }
-                },
-                "service": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
-                  }
-                },
-                "subnetResourceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                  }
-                },
-                "resourceGroupResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
-                  }
-                },
-                "privateDnsZoneGroup": {
-                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
-                  }
-                },
-                "isManualConnection": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. If Manual Private Link Connection is required."
-                  }
-                },
-                "manualConnectionRequestMessage": {
-                  "type": "string",
-                  "nullable": true,
-                  "maxLength": 140,
-                  "metadata": {
-                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
-                  }
-                },
-                "customDnsConfigs": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Custom DNS configurations."
-                  }
-                },
-                "ipConfigurations": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
-                  }
-                },
-                "applicationSecurityGroupResourceIds": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
-                  }
-                },
-                "customNetworkInterfaceName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
-                  }
-                },
-                "lock": {
-                  "$ref": "#/definitions/lockType",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                },
-                "roleAssignments": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/roleAssignmentType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Array of role assignments to create."
-                  }
-                },
-                "tags": {
-                  "type": "object",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
-                  }
-                },
-                "enableTelemetry": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Enable/Disable usage telemetry for module."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "roleAssignmentType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                  }
-                },
-                "roleDefinitionIdOrName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                  }
-                },
-                "principalId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                  }
-                },
-                "principalType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Device",
-                    "ForeignGroup",
-                    "Group",
-                    "ServicePrincipal",
-                    "User"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The principal type of the assigned principal ID."
-                  }
-                },
-                "description": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The description of the role assignment."
-                  }
-                },
-                "condition": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                  }
-                },
-                "conditionVersion": {
-                  "type": "string",
-                  "allowedValues": [
-                    "2.0"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Version of the condition."
-                  }
-                },
-                "delegatedManagedIdentityResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a role assignment.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "secretsOutputType": {
-              "type": "object",
-              "properties": {},
-              "additionalProperties": {
-                "$ref": "#/definitions/_1.secretSetOutputType",
-                "metadata": {
-                  "description": "An exported secret's references."
-                }
-              },
-              "metadata": {
-                "description": "A map of the exported secrets",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. The name of Cognitive Services account."
-              }
-            },
-            "kind": {
-              "type": "string",
-              "allowedValues": [
-                "AIServices",
-                "AnomalyDetector",
-                "CognitiveServices",
-                "ComputerVision",
-                "ContentModerator",
-                "ContentSafety",
-                "ConversationalLanguageUnderstanding",
-                "CustomVision.Prediction",
-                "CustomVision.Training",
-                "Face",
-                "FormRecognizer",
-                "HealthInsights",
-                "ImmersiveReader",
-                "Internal.AllInOne",
-                "LUIS",
-                "LUIS.Authoring",
-                "LanguageAuthoring",
-                "MetricsAdvisor",
-                "OpenAI",
-                "Personalizer",
-                "QnAMaker.v2",
-                "SpeechServices",
-                "TextAnalytics",
-                "TextTranslation"
-              ],
-              "metadata": {
-                "description": "Required. Kind of the Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region."
-              }
-            },
-            "sku": {
-              "type": "string",
-              "defaultValue": "S0",
-              "allowedValues": [
-                "C2",
-                "C3",
-                "C4",
-                "F0",
-                "F1",
-                "S",
-                "S0",
-                "S1",
-                "S10",
-                "S2",
-                "S3",
-                "S4",
-                "S5",
-                "S6",
-                "S7",
-                "S8",
-                "S9"
-              ],
-              "metadata": {
-                "description": "Optional. SKU of the Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region."
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional. Location for all Resources."
-              }
-            },
-            "diagnosticSettings": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/diagnosticSettingFullType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The diagnostic settings of the service."
-              }
-            },
-            "publicNetworkAccess": {
-              "type": "string",
-              "nullable": true,
-              "allowedValues": [
-                "Enabled",
-                "Disabled"
-              ],
-              "metadata": {
-                "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set."
-              }
-            },
-            "customSubDomainName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Conditional. Subdomain name used for token-based authentication. Required if 'networkAcls' or 'privateEndpoints' are set."
-              }
-            },
-            "networkAcls": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. A collection of rules governing the accessibility from specific network locations."
-              }
-            },
-            "privateEndpoints": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/privateEndpointSingleServiceType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
-              }
-            },
-            "lock": {
-              "$ref": "#/definitions/lockType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The lock settings of the service."
-              }
-            },
-            "roleAssignments": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/roleAssignmentType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of role assignments to create."
-              }
-            },
-            "tags": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Tags of the resource."
-              }
-            },
-            "allowedFqdnList": {
-              "type": "array",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. List of allowed FQDN."
-              }
-            },
-            "apiProperties": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The API properties for special APIs."
-              }
-            },
-            "disableLocalAuth": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Allow only Azure AD authentication. Should be enabled for security reasons."
-              }
-            },
-            "customerManagedKey": {
-              "$ref": "#/definitions/customerManagedKeyType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The customer managed key definition."
-              }
-            },
-            "dynamicThrottlingEnabled": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. The flag to enable dynamic throttling."
-              }
-            },
-            "migrationToken": {
-              "type": "securestring",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Resource migration token."
-              }
-            },
-            "restore": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Restore a soft-deleted cognitive service at deployment time. Will fail if no such soft-deleted resource exists."
-              }
-            },
-            "restrictOutboundNetworkAccess": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Restrict outbound network access."
-              }
-            },
-            "userOwnedStorage": {
-              "type": "array",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The storage accounts for this resource."
-              }
-            },
-            "managedIdentities": {
-              "$ref": "#/definitions/managedIdentityAllType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The managed identity definition for this resource."
-              }
-            },
-            "enableTelemetry": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Enable/Disable usage telemetry for module."
-              }
-            },
-            "deployments": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/deploymentType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of deployments about cognitive service accounts to create."
-              }
-            },
-            "secretsExportConfiguration": {
-              "$ref": "#/definitions/secretsExportConfigurationType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Key vault reference and secret settings for the module's secrets export."
-              }
-            },
-            "allowProjectManagement": {
-              "type": "bool",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Enable/Disable project management feature for AI Foundry."
-              }
-            }
-          },
-          "variables": {
-            "copy": [
-              {
-                "name": "formattedRoleAssignments",
-                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-              }
-            ],
-            "enableReferencedModulesTelemetry": false,
-            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
-            "builtInRoleNames": {
-              "Cognitive Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '25fbc0a9-bd7c-42a3-aa1a-3b75d497ee68')]",
-              "Cognitive Services Custom Vision Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c1ff6cc2-c111-46fe-8896-e0ef812ad9f3')]",
-              "Cognitive Services Custom Vision Deployment": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5c4089e1-6d96-4d2f-b296-c1bc7137275f')]",
-              "Cognitive Services Custom Vision Labeler": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '88424f51-ebe7-446f-bc41-7fa16989e96c')]",
-              "Cognitive Services Custom Vision Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '93586559-c37d-4a6b-ba08-b9f0940c2d73')]",
-              "Cognitive Services Custom Vision Trainer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a5ae4ab-0d65-4eeb-be61-29fc9b54394b')]",
-              "Cognitive Services Data Reader (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b59867f0-fa02-499b-be73-45a86b5b3e1c')]",
-              "Cognitive Services Face Recognizer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9894cab4-e18a-44aa-828b-cb588cd6f2d7')]",
-              "Cognitive Services Immersive Reader User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b2de6794-95db-4659-8781-7e080d3f2b9d')]",
-              "Cognitive Services Language Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f07febfe-79bc-46b1-8b37-790e26e6e498')]",
-              "Cognitive Services Language Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7628b7b8-a8b2-4cdc-b46f-e9b35248918e')]",
-              "Cognitive Services Language Writer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f2310ca1-dc64-4889-bb49-c8e0fa3d47a8')]",
-              "Cognitive Services LUIS Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f72c8140-2111-481c-87ff-72b910f6e3f8')]",
-              "Cognitive Services LUIS Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18e81cdc-4e98-4e29-a639-e7d10c5a6226')]",
-              "Cognitive Services LUIS Writer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6322a993-d5c9-4bed-b113-e49bbea25b27')]",
-              "Cognitive Services Metrics Advisor Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'cb43c632-a144-4ec5-977c-e80c4affc34a')]",
-              "Cognitive Services Metrics Advisor User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3b20f47b-3825-43cb-8114-4bd2201156a8')]",
-              "Cognitive Services OpenAI Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a001fd3d-188f-4b5d-821b-7da978bf7442')]",
-              "Cognitive Services OpenAI User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd')]",
-              "Cognitive Services QnA Maker Editor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f4cc2bf9-21be-47a1-bdf1-5c5804381025')]",
-              "Cognitive Services QnA Maker Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '466ccd10-b268-4a11-b098-b4849f024126')]",
-              "Cognitive Services Speech Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0e75ca1e-0464-4b4d-8b93-68208a576181')]",
-              "Cognitive Services Speech User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f2dc8367-1007-4938-bd23-fe263f013447')]",
-              "Cognitive Services User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a97b65f3-24c7-4388-baec-2e87135dc908')]",
-              "Azure AI Developer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '64702f94-c441-49e6-a78b-ef80e0188fee')]",
-              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-            }
-          },
-          "resources": {
-            "cMKKeyVault::cMKKey": {
-              "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
-              "existing": true,
-              "type": "Microsoft.KeyVault/vaults/keys",
-              "apiVersion": "2023-07-01",
-              "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
-              "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
-              "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]"
-            },
-            "avmTelemetry": {
-              "condition": "[parameters('enableTelemetry')]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.cognitiveservices-account.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-              "properties": {
-                "mode": "Incremental",
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "resources": [],
-                  "outputs": {
-                    "telemetry": {
-                      "type": "String",
-                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                    }
-                  }
-                }
-              }
-            },
-            "cMKKeyVault": {
-              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]",
-              "existing": true,
-              "type": "Microsoft.KeyVault/vaults",
-              "apiVersion": "2023-07-01",
-              "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
-              "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
-              "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]"
-            },
-            "cMKUserAssignedIdentity": {
-              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
-              "existing": true,
-              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
-              "apiVersion": "2025-01-31-preview",
-              "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]",
-              "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]",
-              "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]"
-            },
-            "cognitiveService": {
-              "type": "Microsoft.CognitiveServices/accounts",
-              "apiVersion": "2025-04-01-preview",
-              "name": "[parameters('name')]",
-              "kind": "[parameters('kind')]",
-              "identity": "[variables('identity')]",
-              "location": "[parameters('location')]",
-              "tags": "[parameters('tags')]",
-              "sku": {
-                "name": "[parameters('sku')]"
-              },
-              "properties": {
-                "allowProjectManagement": "[parameters('allowProjectManagement')]",
-                "customSubDomainName": "[parameters('customSubDomainName')]",
-                "networkAcls": "[if(not(empty(coalesce(parameters('networkAcls'), createObject()))), createObject('defaultAction', tryGet(parameters('networkAcls'), 'defaultAction'), 'virtualNetworkRules', coalesce(tryGet(parameters('networkAcls'), 'virtualNetworkRules'), createArray()), 'ipRules', coalesce(tryGet(parameters('networkAcls'), 'ipRules'), createArray())), null())]",
-                "publicNetworkAccess": "[if(not(equals(parameters('publicNetworkAccess'), null())), parameters('publicNetworkAccess'), if(not(empty(parameters('networkAcls'))), 'Enabled', 'Disabled'))]",
-                "allowedFqdnList": "[parameters('allowedFqdnList')]",
-                "apiProperties": "[parameters('apiProperties')]",
-                "disableLocalAuth": "[parameters('disableLocalAuth')]",
-                "encryption": "[if(not(empty(parameters('customerManagedKey'))), createObject('keySource', 'Microsoft.KeyVault', 'keyVaultProperties', createObject('identityClientId', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), ''))), reference('cMKUserAssignedIdentity').clientId, null()), 'keyVaultUri', reference('cMKKeyVault').vaultUri, 'keyName', parameters('customerManagedKey').keyName, 'keyVersion', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'keyVersion'), ''))), tryGet(parameters('customerManagedKey'), 'keyVersion'), last(split(reference('cMKKeyVault::cMKKey').keyUriWithVersion, '/'))))), null())]",
-                "migrationToken": "[parameters('migrationToken')]",
-                "restore": "[parameters('restore')]",
-                "restrictOutboundNetworkAccess": "[parameters('restrictOutboundNetworkAccess')]",
-                "userOwnedStorage": "[parameters('userOwnedStorage')]",
-                "dynamicThrottlingEnabled": "[parameters('dynamicThrottlingEnabled')]"
-              },
-              "dependsOn": [
-                "cMKKeyVault",
-                "cMKKeyVault::cMKKey",
-                "cMKUserAssignedIdentity"
-              ]
-            },
-            "cognitiveService_deployments": {
-              "copy": {
-                "name": "cognitiveService_deployments",
-                "count": "[length(coalesce(parameters('deployments'), createArray()))]",
-                "mode": "serial",
-                "batchSize": 1
-              },
-              "type": "Microsoft.CognitiveServices/accounts/deployments",
-              "apiVersion": "2025-04-01-preview",
-              "name": "[format('{0}/{1}', parameters('name'), coalesce(tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'name'), format('{0}-deployments', parameters('name'))))]",
-              "properties": {
-                "model": "[coalesce(parameters('deployments'), createArray())[copyIndex()].model]",
-                "raiPolicyName": "[tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'raiPolicyName')]",
-                "versionUpgradeOption": "[tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'versionUpgradeOption')]"
-              },
-              "sku": "[coalesce(tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'sku'), createObject('name', parameters('sku'), 'capacity', tryGet(parameters('sku'), 'capacity'), 'tier', tryGet(parameters('sku'), 'tier'), 'size', tryGet(parameters('sku'), 'size'), 'family', tryGet(parameters('sku'), 'family')))]",
-              "dependsOn": [
-                "cognitiveService"
-              ]
-            },
-            "cognitiveService_lock": {
-              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-              "type": "Microsoft.Authorization/locks",
-              "apiVersion": "2020-05-01",
-              "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-              "properties": {
-                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-              },
-              "dependsOn": [
-                "cognitiveService"
-              ]
-            },
-            "cognitiveService_diagnosticSettings": {
-              "copy": {
-                "name": "cognitiveService_diagnosticSettings",
-                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-              },
-              "type": "Microsoft.Insights/diagnosticSettings",
-              "apiVersion": "2021-05-01-preview",
-              "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-              "properties": {
-                "copy": [
-                  {
-                    "name": "metrics",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                    "input": {
-                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                      "timeGrain": null
-                    }
-                  },
-                  {
-                    "name": "logs",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                    "input": {
-                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                    }
-                  }
-                ],
-                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-              },
-              "dependsOn": [
-                "cognitiveService"
-              ]
-            },
-            "cognitiveService_roleAssignments": {
-              "copy": {
-                "name": "cognitiveService_roleAssignments",
-                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-              },
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-              "properties": {
-                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-              },
-              "dependsOn": [
-                "cognitiveService"
-              ]
-            },
-            "cognitiveService_privateEndpoints": {
-              "copy": {
-                "name": "cognitiveService_privateEndpoints",
-                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-cognitiveService-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
-              "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex()))]"
-                  },
-                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account')))))), createObject('value', null()))]",
-                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
-                  "subnetResourceId": {
-                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
-                  },
-                  "enableTelemetry": {
-                    "value": "[variables('enableReferencedModulesTelemetry')]"
-                  },
-                  "location": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
-                  },
-                  "lock": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
-                  },
-                  "privateDnsZoneGroup": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                  },
-                  "customDnsConfigs": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
-                  },
-                  "ipConfigurations": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
-                  },
-                  "applicationSecurityGroupResourceIds": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
-                  },
-                  "customNetworkInterfaceName": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "12389807800450456797"
-                    },
-                    "name": "Private Endpoints",
-                    "description": "This module deploys a Private Endpoint."
-                  },
-                  "definitions": {
-                    "privateDnsZoneGroupType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the Private DNS Zone Group."
-                          }
-                        },
-                        "privateDnsZoneGroupConfigs": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                          },
-                          "metadata": {
-                            "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true
-                      }
-                    },
-                    "ipConfigurationType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the resource that is unique within a resource group."
-                          }
-                        },
-                        "properties": {
-                          "type": "object",
-                          "properties": {
-                            "groupId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                              }
-                            },
-                            "memberName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                              }
-                            },
-                            "privateIPAddress": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. Properties of private endpoint IP configurations."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true
-                      }
-                    },
-                    "privateLinkServiceConnectionType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the private link service connection."
-                          }
-                        },
-                        "properties": {
-                          "type": "object",
-                          "properties": {
-                            "groupIds": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "metadata": {
-                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
-                              }
-                            },
-                            "privateLinkServiceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The resource id of private link service."
-                              }
-                            },
-                            "requestMessage": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. Properties of private link service connection."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true
-                      }
-                    },
-                    "customDnsConfigType": {
-                      "type": "object",
-                      "properties": {
-                        "fqdn": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. FQDN that resolves to private endpoint IP address."
-                          }
-                        },
-                        "ipAddresses": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "Required. A list of private IP addresses of the private endpoint."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true
-                      }
-                    },
-                    "lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "privateDnsZoneGroupConfigType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the private DNS zone group config."
-                          }
-                        },
-                        "privateDnsZoneResourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The resource id of the private DNS zone."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "private-dns-zone-group/main.bicep"
-                        }
-                      }
-                    },
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the private endpoint resource to create."
-                      }
-                    },
-                    "subnetResourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                      }
-                    },
-                    "applicationSecurityGroupResourceIds": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
-                      }
-                    },
-                    "customNetworkInterfaceName": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                      }
-                    },
-                    "ipConfigurations": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/ipConfigurationType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
-                      }
-                    },
-                    "privateDnsZoneGroup": {
-                      "$ref": "#/definitions/privateDnsZoneGroupType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The private DNS zone group to configure for the private endpoint."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all Resources."
-                      }
-                    },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The lock settings of the service."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
-                      }
-                    },
-                    "customDnsConfigs": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/customDnsConfigType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Custom DNS configurations."
-                      }
-                    },
-                    "manualPrivateLinkServiceConnections": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/privateLinkServiceConnectionType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
-                      }
-                    },
-                    "privateLinkServiceConnections": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/privateLinkServiceConnectionType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
-                      }
-                    },
-                    "enableTelemetry": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Enable/Disable usage telemetry for module."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
-                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
-                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
-                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
-                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
-                    }
-                  },
-                  "resources": {
-                    "avmTelemetry": {
-                      "condition": "[parameters('enableTelemetry')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2024-03-01",
-                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                      "properties": {
-                        "mode": "Incremental",
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "resources": [],
-                          "outputs": {
-                            "telemetry": {
-                              "type": "String",
-                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "privateEndpoint": {
-                      "type": "Microsoft.Network/privateEndpoints",
-                      "apiVersion": "2024-05-01",
-                      "name": "[parameters('name')]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "copy": [
-                          {
-                            "name": "applicationSecurityGroups",
-                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
-                            "input": {
-                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
-                            }
-                          }
-                        ],
-                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
-                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
-                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
-                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
-                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
-                        "subnet": {
-                          "id": "[parameters('subnetResourceId')]"
-                        }
-                      }
-                    },
-                    "privateEndpoint_lock": {
-                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                      "type": "Microsoft.Authorization/locks",
-                      "apiVersion": "2020-05-01",
-                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                      "properties": {
-                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-                      },
-                      "dependsOn": [
-                        "privateEndpoint"
-                      ]
-                    },
-                    "privateEndpoint_roleAssignments": {
-                      "copy": {
-                        "name": "privateEndpoint_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "privateEndpoint"
-                      ]
-                    },
-                    "privateEndpoint_privateDnsZoneGroup": {
-                      "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
-                          },
-                          "privateEndpointName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "privateDnsZoneConfigs": {
-                            "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.34.44.8038",
-                              "templateHash": "13997305779829540948"
-                            },
-                            "name": "Private Endpoint Private DNS Zone Groups",
-                            "description": "This module deploys a Private Endpoint Private DNS Zone Group."
-                          },
-                          "definitions": {
-                            "privateDnsZoneGroupConfigType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of the private DNS zone group config."
-                                  }
-                                },
-                                "privateDnsZoneResourceId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The resource id of the private DNS zone."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "privateEndpointName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "privateDnsZoneConfigs": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                              },
-                              "minLength": 1,
-                              "maxLength": 5,
-                              "metadata": {
-                                "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "defaultValue": "default",
-                              "metadata": {
-                                "description": "Optional. The name of the private DNS zone group."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "copy": [
-                              {
-                                "name": "privateDnsZoneConfigsVar",
-                                "count": "[length(parameters('privateDnsZoneConfigs'))]",
-                                "input": {
-                                  "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
-                                  "properties": {
-                                    "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
-                                  }
-                                }
-                              }
-                            ]
-                          },
-                          "resources": {
-                            "privateEndpoint": {
-                              "existing": true,
-                              "type": "Microsoft.Network/privateEndpoints",
-                              "apiVersion": "2024-05-01",
-                              "name": "[parameters('privateEndpointName')]"
-                            },
-                            "privateDnsZoneGroup": {
-                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
-                              "apiVersion": "2024-05-01",
-                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
-                              "properties": {
-                                "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the private endpoint DNS zone group."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the private endpoint DNS zone group."
-                              },
-                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group the private endpoint DNS zone group was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "privateEndpoint"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group the private endpoint was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the private endpoint."
-                      },
-                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the private endpoint."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]"
-                    },
-                    "customDnsConfigs": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/customDnsConfigType"
-                      },
-                      "metadata": {
-                        "description": "The custom DNS configurations of the private endpoint."
-                      },
-                      "value": "[reference('privateEndpoint').customDnsConfigs]"
-                    },
-                    "networkInterfaceResourceIds": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "metadata": {
-                        "description": "The resource IDs of the network interfaces associated with the private endpoint."
-                      },
-                      "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
-                    },
-                    "groupId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "The group Id for the private endpoint Group."
-                      },
-                      "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "cognitiveService"
-              ]
-            },
-            "secretsExport": {
-              "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]",
-              "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]",
-              "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "keyVaultName": {
-                    "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]"
-                  },
-                  "secretsToSet": {
-                    "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'accessKey1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey1Name'), 'value', listKeys('cognitiveService', '2025-04-01-preview').key1)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'accessKey2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey2Name'), 'value', listKeys('cognitiveService', '2025-04-01-preview').key2)), createArray()))]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.36.1.42791",
-                      "templateHash": "1200612323329026557"
-                    }
-                  },
-                  "definitions": {
-                    "secretSetOutputType": {
-                      "type": "object",
-                      "properties": {
-                        "secretResourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "The resourceId of the exported secret."
-                          }
-                        },
-                        "secretUri": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "The secret URI of the exported secret."
-                          }
-                        },
-                        "secretUriWithVersion": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "The secret URI with version of the exported secret."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "secretToSetType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the secret to set."
-                          }
-                        },
-                        "value": {
-                          "type": "securestring",
-                          "metadata": {
-                            "description": "Required. The value of the secret to set."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for the secret to set via the secrets export feature.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "keyVaultName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the Key Vault to set the ecrets in."
-                      }
-                    },
-                    "secretsToSet": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/secretToSetType"
-                      },
-                      "metadata": {
-                        "description": "Required. The secrets to set in the Key Vault."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "keyVault": {
-                      "existing": true,
-                      "type": "Microsoft.KeyVault/vaults",
-                      "apiVersion": "2023-07-01",
-                      "name": "[parameters('keyVaultName')]"
-                    },
-                    "secrets": {
-                      "copy": {
-                        "name": "secrets",
-                        "count": "[length(parameters('secretsToSet'))]"
-                      },
-                      "type": "Microsoft.KeyVault/vaults/secrets",
-                      "apiVersion": "2023-07-01",
-                      "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]",
-                      "properties": {
-                        "value": "[parameters('secretsToSet')[copyIndex()].value]"
-                      }
-                    }
-                  },
-                  "outputs": {
-                    "secretsSet": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/secretSetOutputType"
-                      },
-                      "metadata": {
-                        "description": "The references to the secrets exported to the provided Key Vault."
-                      },
-                      "copy": {
-                        "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]",
-                        "input": {
-                          "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]",
-                          "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]",
-                          "secretUriWithVersion": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUriWithVersion]"
-                        }
-                      }
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "cognitiveService"
-              ]
-            }
-          },
-          "outputs": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the cognitive services account."
-              },
-              "value": "[parameters('name')]"
-            },
-            "resourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource ID of the cognitive services account."
-              },
-              "value": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]"
-            },
-            "resourceGroupName": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource group the cognitive services account was deployed into."
-              },
-              "value": "[resourceGroup().name]"
-            },
-            "endpoint": {
-              "type": "string",
-              "metadata": {
-                "description": "The service endpoint of the cognitive services account."
-              },
-              "value": "[reference('cognitiveService').endpoint]"
-            },
-            "endpoints": {
-              "$ref": "#/definitions/endpointType",
-              "metadata": {
-                "description": "All endpoints available for the cognitive services account, types depends on the cognitive service kind."
-              },
-              "value": "[reference('cognitiveService').endpoints]"
-            },
-            "systemAssignedMIPrincipalId": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "The principal ID of the system assigned identity."
-              },
-              "value": "[tryGet(tryGet(reference('cognitiveService', '2025-04-01-preview', 'full'), 'identity'), 'principalId')]"
-            },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "The location the resource was deployed into."
-              },
-              "value": "[reference('cognitiveService', '2025-04-01-preview', 'full').location]"
-            },
-            "exportedSecrets": {
-              "$ref": "#/definitions/secretsOutputType",
-              "metadata": {
-                "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name."
-              },
-              "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]"
-            },
-            "privateEndpoints": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/privateEndpointOutputType"
-              },
-              "metadata": {
-                "description": "The private endpoints of the congitive services account."
-              },
-              "copy": {
-                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
-                "input": {
-                  "name": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
-                  "resourceId": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
-                  "groupId": "[tryGet(tryGet(reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
-                  "customDnsConfigs": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
-                  "networkInterfaceResourceIds": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
-                }
-              }
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "logAnalyticsWorkspace",
-        "virtualNetwork"
-      ]
-    },
-    "privateDnsZonesCosmosDb": {
-      "condition": "[variables('virtualNetworkEnabled')]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2022-09-01",
-      "name": "[take(format('avm.res.network.private-dns-zone.cosmos-db.{0}', parameters('solutionPrefix')), 64)]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "privatelink.documents.azure.com"
-          },
-          "enableTelemetry": {
-            "value": "[parameters('enableTelemetry')]"
-          },
-          "virtualNetworkLinks": {
-            "value": [
-              {
-                "name": "vnetlink-cosmosdb",
-                "virtualNetworkResourceId": "[reference('virtualNetwork').outputs.resourceId.value]"
-              }
-            ]
-          },
-          "tags": {
-            "value": "[parameters('tags')]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.32.4.45862",
-              "templateHash": "83178825086050429"
-            },
-            "name": "Private DNS Zones",
-            "description": "This module deploys a Private DNS zone.",
-            "owner": "Azure/module-maintainers"
-          },
-          "definitions": {
-            "roleAssignmentType": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                    }
-                  },
-                  "roleDefinitionIdOrName": {
-                    "type": "string",
-                    "metadata": {
-                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                    }
-                  },
-                  "principalId": {
-                    "type": "string",
-                    "metadata": {
-                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                    }
-                  },
-                  "principalType": {
-                    "type": "string",
-                    "allowedValues": [
-                      "Device",
-                      "ForeignGroup",
-                      "Group",
-                      "ServicePrincipal",
-                      "User"
-                    ],
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The principal type of the assigned principal ID."
-                    }
-                  },
-                  "description": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The description of the role assignment."
-                    }
-                  },
-                  "condition": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                    }
-                  },
-                  "conditionVersion": {
-                    "type": "string",
-                    "allowedValues": [
-                      "2.0"
-                    ],
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. Version of the condition."
-                    }
-                  },
-                  "delegatedManagedIdentityResourceId": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The Resource Id of the delegated managed identity resource."
-                    }
-                  }
-                }
-              },
-              "nullable": true
-            },
-            "lockType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of lock."
-                  }
-                },
-                "kind": {
-                  "type": "string",
-                  "allowedValues": [
-                    "CanNotDelete",
-                    "None",
-                    "ReadOnly"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                }
-              },
-              "nullable": true
-            },
-            "aType": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string",
-                    "metadata": {
-                      "description": "Required. The name of the record."
-                    }
-                  },
-                  "metadata": {
-                    "type": "object",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The metadata of the record."
-                    }
-                  },
-                  "ttl": {
-                    "type": "int",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The TTL of the record."
-                    }
-                  },
-                  "roleAssignments": {
-                    "$ref": "#/definitions/roleAssignmentType",
-                    "metadata": {
-                      "description": "Optional. Array of role assignments to create."
-                    }
-                  },
-                  "aRecords": {
-                    "type": "array",
-                    "items": {
-                      "type": "object",
-                      "properties": {
-                        "ipv4Address": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The IPv4 address of this A record."
-                          }
-                        }
-                      }
-                    },
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The list of A records in the record set."
-                    }
-                  }
-                }
-              },
-              "nullable": true
-            },
-            "aaaaType": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string",
-                    "metadata": {
-                      "description": "Required. The name of the record."
-                    }
-                  },
-                  "metadata": {
-                    "type": "object",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The metadata of the record."
-                    }
-                  },
-                  "ttl": {
-                    "type": "int",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The TTL of the record."
-                    }
-                  },
-                  "roleAssignments": {
-                    "$ref": "#/definitions/roleAssignmentType",
-                    "metadata": {
-                      "description": "Optional. Array of role assignments to create."
-                    }
-                  },
-                  "aaaaRecords": {
-                    "type": "array",
-                    "items": {
-                      "type": "object",
-                      "properties": {
-                        "ipv6Address": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The IPv6 address of this AAAA record."
-                          }
-                        }
-                      }
-                    },
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The list of AAAA records in the record set."
-                    }
-                  }
-                }
-              },
-              "nullable": true
-            },
-            "cnameType": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string",
-                    "metadata": {
-                      "description": "Required. The name of the record."
-                    }
-                  },
-                  "metadata": {
-                    "type": "object",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The metadata of the record."
-                    }
-                  },
-                  "ttl": {
-                    "type": "int",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The TTL of the record."
-                    }
-                  },
-                  "roleAssignments": {
-                    "$ref": "#/definitions/roleAssignmentType",
-                    "metadata": {
-                      "description": "Optional. Array of role assignments to create."
-                    }
-                  },
-                  "cnameRecord": {
-                    "type": "object",
-                    "properties": {
-                      "cname": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. The canonical name of the CNAME record."
-                        }
-                      }
-                    },
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The CNAME record in the record set."
-                    }
-                  }
-                }
-              },
-              "nullable": true
-            },
-            "mxType": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string",
-                    "metadata": {
-                      "description": "Required. The name of the record."
-                    }
-                  },
-                  "metadata": {
-                    "type": "object",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The metadata of the record."
-                    }
-                  },
-                  "ttl": {
-                    "type": "int",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The TTL of the record."
-                    }
-                  },
-                  "roleAssignments": {
-                    "$ref": "#/definitions/roleAssignmentType",
-                    "metadata": {
-                      "description": "Optional. Array of role assignments to create."
-                    }
-                  },
-                  "mxRecords": {
-                    "type": "array",
-                    "items": {
-                      "type": "object",
-                      "properties": {
-                        "exchange": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The domain name of the mail host for this MX record."
-                          }
-                        },
-                        "preference": {
-                          "type": "int",
-                          "metadata": {
-                            "description": "Required. The preference value for this MX record."
-                          }
-                        }
-                      }
-                    },
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The list of MX records in the record set."
-                    }
-                  }
-                }
-              },
-              "nullable": true
-            },
-            "ptrType": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string",
-                    "metadata": {
-                      "description": "Required. The name of the record."
-                    }
-                  },
-                  "metadata": {
-                    "type": "object",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The metadata of the record."
-                    }
-                  },
-                  "ttl": {
-                    "type": "int",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The TTL of the record."
-                    }
-                  },
-                  "roleAssignments": {
-                    "$ref": "#/definitions/roleAssignmentType",
-                    "metadata": {
-                      "description": "Optional. Array of role assignments to create."
-                    }
-                  },
-                  "ptrRecords": {
-                    "type": "array",
-                    "items": {
-                      "type": "object",
-                      "properties": {
-                        "ptrdname": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The PTR target domain name for this PTR record."
-                          }
-                        }
-                      }
-                    },
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The list of PTR records in the record set."
-                    }
-                  }
-                }
-              },
-              "nullable": true
-            },
-            "soaType": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string",
-                    "metadata": {
-                      "description": "Required. The name of the record."
-                    }
-                  },
-                  "metadata": {
-                    "type": "object",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The metadata of the record."
-                    }
-                  },
-                  "ttl": {
-                    "type": "int",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The TTL of the record."
-                    }
-                  },
-                  "roleAssignments": {
-                    "$ref": "#/definitions/roleAssignmentType",
-                    "metadata": {
-                      "description": "Optional. Array of role assignments to create."
-                    }
-                  },
-                  "soaRecord": {
-                    "type": "object",
-                    "properties": {
-                      "email": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. The email contact for this SOA record."
-                        }
-                      },
-                      "expireTime": {
-                        "type": "int",
-                        "metadata": {
-                          "description": "Required. The expire time for this SOA record."
-                        }
-                      },
-                      "host": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. The domain name of the authoritative name server for this SOA record."
-                        }
-                      },
-                      "minimumTtl": {
-                        "type": "int",
-                        "metadata": {
-                          "description": "Required. The minimum value for this SOA record. By convention this is used to determine the negative caching duration."
-                        }
-                      },
-                      "refreshTime": {
-                        "type": "int",
-                        "metadata": {
-                          "description": "Required. The refresh value for this SOA record."
-                        }
-                      },
-                      "retryTime": {
-                        "type": "int",
-                        "metadata": {
-                          "description": "Required. The retry time for this SOA record."
-                        }
-                      },
-                      "serialNumber": {
-                        "type": "int",
-                        "metadata": {
-                          "description": "Required. The serial number for this SOA record."
-                        }
-                      }
-                    },
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The SOA record in the record set."
-                    }
-                  }
-                }
-              },
-              "nullable": true
-            },
-            "srvType": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string",
-                    "metadata": {
-                      "description": "Required. The name of the record."
-                    }
-                  },
-                  "metadata": {
-                    "type": "object",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The metadata of the record."
-                    }
-                  },
-                  "ttl": {
-                    "type": "int",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The TTL of the record."
-                    }
-                  },
-                  "roleAssignments": {
-                    "$ref": "#/definitions/roleAssignmentType",
-                    "metadata": {
-                      "description": "Optional. Array of role assignments to create."
-                    }
-                  },
-                  "srvRecords": {
-                    "type": "array",
-                    "items": {
-                      "type": "object",
-                      "properties": {
-                        "priority": {
-                          "type": "int",
-                          "metadata": {
-                            "description": "Required. The priority value for this SRV record."
-                          }
-                        },
-                        "weight": {
-                          "type": "int",
-                          "metadata": {
-                            "description": "Required. The weight value for this SRV record."
-                          }
-                        },
-                        "port": {
-                          "type": "int",
-                          "metadata": {
-                            "description": "Required. The port value for this SRV record."
-                          }
-                        },
-                        "target": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The target domain name for this SRV record."
-                          }
-                        }
-                      }
-                    },
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The list of SRV records in the record set."
-                    }
-                  }
-                }
-              },
-              "nullable": true
-            },
-            "txtType": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string",
-                    "metadata": {
-                      "description": "Required. The name of the record."
-                    }
-                  },
-                  "metadata": {
-                    "type": "object",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The metadata of the record."
-                    }
-                  },
-                  "ttl": {
-                    "type": "int",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The TTL of the record."
-                    }
-                  },
-                  "roleAssignments": {
-                    "$ref": "#/definitions/roleAssignmentType",
-                    "metadata": {
-                      "description": "Optional. Array of role assignments to create."
-                    }
-                  },
-                  "txtRecords": {
-                    "type": "array",
-                    "items": {
-                      "type": "object",
-                      "properties": {
-                        "value": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "Required. The text value of this TXT record."
-                          }
-                        }
-                      }
-                    },
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The list of TXT records in the record set."
-                    }
-                  }
-                }
-              },
-              "nullable": true
-            },
-            "virtualNetworkLinkType": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string",
-                    "nullable": true,
-                    "minLength": 1,
-                    "maxLength": 80,
-                    "metadata": {
-                      "description": "Optional. The resource name."
-                    }
-                  },
-                  "virtualNetworkResourceId": {
-                    "type": "string",
-                    "metadata": {
-                      "description": "Required. The resource ID of the virtual network to link."
-                    }
-                  },
-                  "location": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The Azure Region where the resource lives."
-                    }
-                  },
-                  "registrationEnabled": {
-                    "type": "bool",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. Is auto-registration of virtual machine records in the virtual network in the Private DNS zone enabled?."
-                    }
-                  },
-                  "tags": {
-                    "type": "object",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. Resource tags."
-                    }
-                  },
-                  "resolutionPolicy": {
-                    "type": "string",
-                    "allowedValues": [
-                      "Default",
-                      "NxDomainRedirect"
-                    ],
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The resolution type of the private-dns-zone fallback machanism."
-                    }
-                  }
-                }
-              },
-              "nullable": true
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. Private DNS zone name."
-              }
-            },
-            "a": {
-              "$ref": "#/definitions/aType",
-              "metadata": {
-                "description": "Optional. Array of A records."
-              }
-            },
-            "aaaa": {
-              "$ref": "#/definitions/aaaaType",
-              "metadata": {
-                "description": "Optional. Array of AAAA records."
-              }
-            },
-            "cname": {
-              "$ref": "#/definitions/cnameType",
-              "metadata": {
-                "description": "Optional. Array of CNAME records."
-              }
-            },
-            "mx": {
-              "$ref": "#/definitions/mxType",
-              "metadata": {
-                "description": "Optional. Array of MX records."
-              }
-            },
-            "ptr": {
-              "$ref": "#/definitions/ptrType",
-              "metadata": {
-                "description": "Optional. Array of PTR records."
-              }
-            },
-            "soa": {
-              "$ref": "#/definitions/soaType",
-              "metadata": {
-                "description": "Optional. Array of SOA records."
-              }
-            },
-            "srv": {
-              "$ref": "#/definitions/srvType",
-              "metadata": {
-                "description": "Optional. Array of SRV records."
-              }
-            },
-            "txt": {
-              "$ref": "#/definitions/txtType",
-              "metadata": {
-                "description": "Optional. Array of TXT records."
-              }
-            },
-            "virtualNetworkLinks": {
-              "$ref": "#/definitions/virtualNetworkLinkType",
-              "metadata": {
-                "description": "Optional. Array of custom objects describing vNet links of the DNS zone. Each object should contain properties 'virtualNetworkResourceId' and 'registrationEnabled'. The 'vnetResourceId' is a resource ID of a vNet to link, 'registrationEnabled' (bool) enables automatic DNS registration in the zone for the linked vNet."
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "global",
-              "metadata": {
-                "description": "Optional. The location of the PrivateDNSZone. Should be global."
-              }
-            },
-            "roleAssignments": {
-              "$ref": "#/definitions/roleAssignmentType",
-              "metadata": {
-                "description": "Optional. Array of role assignments to create."
-              }
-            },
-            "tags": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Tags of the resource."
-              }
-            },
-            "lock": {
-              "$ref": "#/definitions/lockType",
-              "metadata": {
-                "description": "Optional. The lock settings of the service."
-              }
-            },
-            "enableTelemetry": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Enable/Disable usage telemetry for module."
-              }
-            }
-          },
-          "variables": {
-            "copy": [
-              {
-                "name": "formattedRoleAssignments",
-                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-              }
-            ],
-            "builtInRoleNames": {
-              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
-            }
-          },
-          "resources": {
-            "avmTelemetry": {
-              "condition": "[parameters('enableTelemetry')]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privatednszone.{0}.{1}', replace('0.7.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-              "properties": {
-                "mode": "Incremental",
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "resources": [],
-                  "outputs": {
-                    "telemetry": {
-                      "type": "String",
-                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                    }
-                  }
-                }
-              }
-            },
-            "privateDnsZone": {
-              "type": "Microsoft.Network/privateDnsZones",
-              "apiVersion": "2020-06-01",
-              "name": "[parameters('name')]",
-              "location": "[parameters('location')]",
-              "tags": "[parameters('tags')]"
-            },
-            "privateDnsZone_lock": {
-              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-              "type": "Microsoft.Authorization/locks",
-              "apiVersion": "2020-05-01",
-              "scope": "[format('Microsoft.Network/privateDnsZones/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-              "properties": {
-                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-              },
-              "dependsOn": [
-                "privateDnsZone"
-              ]
-            },
-            "privateDnsZone_roleAssignments": {
-              "copy": {
-                "name": "privateDnsZone_roleAssignments",
-                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-              },
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[format('Microsoft.Network/privateDnsZones/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-              "properties": {
-                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-              },
-              "dependsOn": [
-                "privateDnsZone"
-              ]
-            },
-            "privateDnsZone_A": {
-              "copy": {
-                "name": "privateDnsZone_A",
-                "count": "[length(coalesce(parameters('a'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-PrivateDnsZone-ARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "privateDnsZoneName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(parameters('a'), createArray())[copyIndex()].name]"
-                  },
-                  "aRecords": {
-                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'aRecords')]"
-                  },
-                  "metadata": {
-                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'metadata')]"
-                  },
-                  "ttl": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'ttl'), 3600)]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'roleAssignments')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.32.4.45862",
-                      "templateHash": "2531120132215940282"
-                    },
-                    "name": "Private DNS Zone A record",
-                    "description": "This module deploys a Private DNS Zone A record.",
-                    "owner": "Azure/module-maintainers"
-                  },
-                  "definitions": {
-                    "roleAssignmentType": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "name": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                            }
-                          },
-                          "roleDefinitionIdOrName": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                            }
-                          },
-                          "principalId": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                            }
-                          },
-                          "principalType": {
-                            "type": "string",
-                            "allowedValues": [
-                              "Device",
-                              "ForeignGroup",
-                              "Group",
-                              "ServicePrincipal",
-                              "User"
-                            ],
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The principal type of the assigned principal ID."
-                            }
-                          },
-                          "description": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The description of the role assignment."
-                            }
-                          },
-                          "condition": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                            }
-                          },
-                          "conditionVersion": {
-                            "type": "string",
-                            "allowedValues": [
-                              "2.0"
-                            ],
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. Version of the condition."
-                            }
-                          },
-                          "delegatedManagedIdentityResourceId": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The Resource Id of the delegated managed identity resource."
-                            }
-                          }
-                        }
-                      },
-                      "nullable": true
-                    }
-                  },
-                  "parameters": {
-                    "privateDnsZoneName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the A record."
-                      }
-                    },
-                    "aRecords": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The list of A records in the record set."
-                      }
-                    },
-                    "metadata": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The metadata attached to the record set."
-                      }
-                    },
-                    "ttl": {
-                      "type": "int",
-                      "defaultValue": 3600,
-                      "metadata": {
-                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
-                      }
-                    },
-                    "roleAssignments": {
-                      "$ref": "#/definitions/roleAssignmentType",
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "privateDnsZone": {
-                      "existing": true,
-                      "type": "Microsoft.Network/privateDnsZones",
-                      "apiVersion": "2020-06-01",
-                      "name": "[parameters('privateDnsZoneName')]"
-                    },
-                    "A": {
-                      "type": "Microsoft.Network/privateDnsZones/A",
-                      "apiVersion": "2020-06-01",
-                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "properties": {
-                        "aRecords": "[parameters('aRecords')]",
-                        "metadata": "[parameters('metadata')]",
-                        "ttl": "[parameters('ttl')]"
-                      }
-                    },
-                    "A_roleAssignments": {
-                      "copy": {
-                        "name": "A_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/A/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "A"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed A record."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed A record."
-                      },
-                      "value": "[resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group of the deployed A record."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "privateDnsZone"
-              ]
-            },
-            "privateDnsZone_AAAA": {
-              "copy": {
-                "name": "privateDnsZone_AAAA",
-                "count": "[length(coalesce(parameters('aaaa'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-PrivateDnsZone-AAAARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "privateDnsZoneName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(parameters('aaaa'), createArray())[copyIndex()].name]"
-                  },
-                  "aaaaRecords": {
-                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'aaaaRecords')]"
-                  },
-                  "metadata": {
-                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'metadata')]"
-                  },
-                  "ttl": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'ttl'), 3600)]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'roleAssignments')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.32.4.45862",
-                      "templateHash": "16709340450244912125"
-                    },
-                    "name": "Private DNS Zone AAAA record",
-                    "description": "This module deploys a Private DNS Zone AAAA record.",
-                    "owner": "Azure/module-maintainers"
-                  },
-                  "definitions": {
-                    "roleAssignmentType": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "name": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                            }
-                          },
-                          "roleDefinitionIdOrName": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                            }
-                          },
-                          "principalId": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                            }
-                          },
-                          "principalType": {
-                            "type": "string",
-                            "allowedValues": [
-                              "Device",
-                              "ForeignGroup",
-                              "Group",
-                              "ServicePrincipal",
-                              "User"
-                            ],
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The principal type of the assigned principal ID."
-                            }
-                          },
-                          "description": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The description of the role assignment."
-                            }
-                          },
-                          "condition": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                            }
-                          },
-                          "conditionVersion": {
-                            "type": "string",
-                            "allowedValues": [
-                              "2.0"
-                            ],
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. Version of the condition."
-                            }
-                          },
-                          "delegatedManagedIdentityResourceId": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The Resource Id of the delegated managed identity resource."
-                            }
-                          }
-                        }
-                      },
-                      "nullable": true
-                    }
-                  },
-                  "parameters": {
-                    "privateDnsZoneName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the AAAA record."
-                      }
-                    },
-                    "aaaaRecords": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The list of AAAA records in the record set."
-                      }
-                    },
-                    "metadata": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The metadata attached to the record set."
-                      }
-                    },
-                    "ttl": {
-                      "type": "int",
-                      "defaultValue": 3600,
-                      "metadata": {
-                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
-                      }
-                    },
-                    "roleAssignments": {
-                      "$ref": "#/definitions/roleAssignmentType",
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "privateDnsZone": {
-                      "existing": true,
-                      "type": "Microsoft.Network/privateDnsZones",
-                      "apiVersion": "2020-06-01",
-                      "name": "[parameters('privateDnsZoneName')]"
-                    },
-                    "AAAA": {
-                      "type": "Microsoft.Network/privateDnsZones/AAAA",
-                      "apiVersion": "2020-06-01",
-                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "properties": {
-                        "aaaaRecords": "[parameters('aaaaRecords')]",
-                        "metadata": "[parameters('metadata')]",
-                        "ttl": "[parameters('ttl')]"
-                      }
-                    },
-                    "AAAA_roleAssignments": {
-                      "copy": {
-                        "name": "AAAA_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/AAAA/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "AAAA"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed AAAA record."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed AAAA record."
-                      },
-                      "value": "[resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group of the deployed AAAA record."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "privateDnsZone"
-              ]
-            },
-            "privateDnsZone_CNAME": {
-              "copy": {
-                "name": "privateDnsZone_CNAME",
-                "count": "[length(coalesce(parameters('cname'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-PrivateDnsZone-CNAMERecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "privateDnsZoneName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(parameters('cname'), createArray())[copyIndex()].name]"
-                  },
-                  "cnameRecord": {
-                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'cnameRecord')]"
-                  },
-                  "metadata": {
-                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'metadata')]"
-                  },
-                  "ttl": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'ttl'), 3600)]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'roleAssignments')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.32.4.45862",
-                      "templateHash": "9976020649752073181"
-                    },
-                    "name": "Private DNS Zone CNAME record",
-                    "description": "This module deploys a Private DNS Zone CNAME record.",
-                    "owner": "Azure/module-maintainers"
-                  },
-                  "definitions": {
-                    "roleAssignmentType": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "name": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                            }
-                          },
-                          "roleDefinitionIdOrName": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                            }
-                          },
-                          "principalId": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                            }
-                          },
-                          "principalType": {
-                            "type": "string",
-                            "allowedValues": [
-                              "Device",
-                              "ForeignGroup",
-                              "Group",
-                              "ServicePrincipal",
-                              "User"
-                            ],
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The principal type of the assigned principal ID."
-                            }
-                          },
-                          "description": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The description of the role assignment."
-                            }
-                          },
-                          "condition": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                            }
-                          },
-                          "conditionVersion": {
-                            "type": "string",
-                            "allowedValues": [
-                              "2.0"
-                            ],
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. Version of the condition."
-                            }
-                          },
-                          "delegatedManagedIdentityResourceId": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The Resource Id of the delegated managed identity resource."
-                            }
-                          }
-                        }
-                      },
-                      "nullable": true
-                    }
-                  },
-                  "parameters": {
-                    "privateDnsZoneName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the CNAME record."
-                      }
-                    },
-                    "cnameRecord": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. A CNAME record."
-                      }
-                    },
-                    "metadata": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The metadata attached to the record set."
-                      }
-                    },
-                    "ttl": {
-                      "type": "int",
-                      "defaultValue": 3600,
-                      "metadata": {
-                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
-                      }
-                    },
-                    "roleAssignments": {
-                      "$ref": "#/definitions/roleAssignmentType",
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "privateDnsZone": {
-                      "existing": true,
-                      "type": "Microsoft.Network/privateDnsZones",
-                      "apiVersion": "2020-06-01",
-                      "name": "[parameters('privateDnsZoneName')]"
-                    },
-                    "CNAME": {
-                      "type": "Microsoft.Network/privateDnsZones/CNAME",
-                      "apiVersion": "2020-06-01",
-                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "properties": {
-                        "cnameRecord": "[parameters('cnameRecord')]",
-                        "metadata": "[parameters('metadata')]",
-                        "ttl": "[parameters('ttl')]"
-                      }
-                    },
-                    "CNAME_roleAssignments": {
-                      "copy": {
-                        "name": "CNAME_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/CNAME/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "CNAME"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed CNAME record."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed CNAME record."
-                      },
-                      "value": "[resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group of the deployed CNAME record."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "privateDnsZone"
-              ]
-            },
-            "privateDnsZone_MX": {
-              "copy": {
-                "name": "privateDnsZone_MX",
-                "count": "[length(coalesce(parameters('mx'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-PrivateDnsZone-MXRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "privateDnsZoneName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(parameters('mx'), createArray())[copyIndex()].name]"
-                  },
-                  "metadata": {
-                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'metadata')]"
-                  },
-                  "mxRecords": {
-                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'mxRecords')]"
-                  },
-                  "ttl": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'ttl'), 3600)]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'roleAssignments')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.32.4.45862",
-                      "templateHash": "2520323624213076361"
-                    },
-                    "name": "Private DNS Zone MX record",
-                    "description": "This module deploys a Private DNS Zone MX record.",
-                    "owner": "Azure/module-maintainers"
-                  },
-                  "definitions": {
-                    "roleAssignmentType": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "name": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                            }
-                          },
-                          "roleDefinitionIdOrName": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                            }
-                          },
-                          "principalId": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                            }
-                          },
-                          "principalType": {
-                            "type": "string",
-                            "allowedValues": [
-                              "Device",
-                              "ForeignGroup",
-                              "Group",
-                              "ServicePrincipal",
-                              "User"
-                            ],
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The principal type of the assigned principal ID."
-                            }
-                          },
-                          "description": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The description of the role assignment."
-                            }
-                          },
-                          "condition": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                            }
-                          },
-                          "conditionVersion": {
-                            "type": "string",
-                            "allowedValues": [
-                              "2.0"
-                            ],
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. Version of the condition."
-                            }
-                          },
-                          "delegatedManagedIdentityResourceId": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The Resource Id of the delegated managed identity resource."
-                            }
-                          }
-                        }
-                      },
-                      "nullable": true
-                    }
-                  },
-                  "parameters": {
-                    "privateDnsZoneName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the MX record."
-                      }
-                    },
-                    "metadata": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The metadata attached to the record set."
-                      }
-                    },
-                    "mxRecords": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The list of MX records in the record set."
-                      }
-                    },
-                    "ttl": {
-                      "type": "int",
-                      "defaultValue": 3600,
-                      "metadata": {
-                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
-                      }
-                    },
-                    "roleAssignments": {
-                      "$ref": "#/definitions/roleAssignmentType",
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "privateDnsZone": {
-                      "existing": true,
-                      "type": "Microsoft.Network/privateDnsZones",
-                      "apiVersion": "2020-06-01",
-                      "name": "[parameters('privateDnsZoneName')]"
-                    },
-                    "MX": {
-                      "type": "Microsoft.Network/privateDnsZones/MX",
-                      "apiVersion": "2020-06-01",
-                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "properties": {
-                        "metadata": "[parameters('metadata')]",
-                        "mxRecords": "[parameters('mxRecords')]",
-                        "ttl": "[parameters('ttl')]"
-                      }
-                    },
-                    "MX_roleAssignments": {
-                      "copy": {
-                        "name": "MX_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/MX/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "MX"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed MX record."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed MX record."
-                      },
-                      "value": "[resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group of the deployed MX record."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "privateDnsZone"
-              ]
-            },
-            "privateDnsZone_PTR": {
-              "copy": {
-                "name": "privateDnsZone_PTR",
-                "count": "[length(coalesce(parameters('ptr'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-PrivateDnsZone-PTRRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "privateDnsZoneName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(parameters('ptr'), createArray())[copyIndex()].name]"
-                  },
-                  "metadata": {
-                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'metadata')]"
-                  },
-                  "ptrRecords": {
-                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'ptrRecords')]"
-                  },
-                  "ttl": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'ttl'), 3600)]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'roleAssignments')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.32.4.45862",
-                      "templateHash": "3080404733048745471"
-                    },
-                    "name": "Private DNS Zone PTR record",
-                    "description": "This module deploys a Private DNS Zone PTR record.",
-                    "owner": "Azure/module-maintainers"
-                  },
-                  "definitions": {
-                    "roleAssignmentType": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "name": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                            }
-                          },
-                          "roleDefinitionIdOrName": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                            }
-                          },
-                          "principalId": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                            }
-                          },
-                          "principalType": {
-                            "type": "string",
-                            "allowedValues": [
-                              "Device",
-                              "ForeignGroup",
-                              "Group",
-                              "ServicePrincipal",
-                              "User"
-                            ],
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The principal type of the assigned principal ID."
-                            }
-                          },
-                          "description": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The description of the role assignment."
-                            }
-                          },
-                          "condition": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                            }
-                          },
-                          "conditionVersion": {
-                            "type": "string",
-                            "allowedValues": [
-                              "2.0"
-                            ],
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. Version of the condition."
-                            }
-                          },
-                          "delegatedManagedIdentityResourceId": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The Resource Id of the delegated managed identity resource."
-                            }
-                          }
-                        }
-                      },
-                      "nullable": true
-                    }
-                  },
-                  "parameters": {
-                    "privateDnsZoneName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the PTR record."
-                      }
-                    },
-                    "metadata": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The metadata attached to the record set."
-                      }
-                    },
-                    "ptrRecords": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The list of PTR records in the record set."
-                      }
-                    },
-                    "ttl": {
-                      "type": "int",
-                      "defaultValue": 3600,
-                      "metadata": {
-                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
-                      }
-                    },
-                    "roleAssignments": {
-                      "$ref": "#/definitions/roleAssignmentType",
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "privateDnsZone": {
-                      "existing": true,
-                      "type": "Microsoft.Network/privateDnsZones",
-                      "apiVersion": "2020-06-01",
-                      "name": "[parameters('privateDnsZoneName')]"
-                    },
-                    "PTR": {
-                      "type": "Microsoft.Network/privateDnsZones/PTR",
-                      "apiVersion": "2020-06-01",
-                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "properties": {
-                        "metadata": "[parameters('metadata')]",
-                        "ptrRecords": "[parameters('ptrRecords')]",
-                        "ttl": "[parameters('ttl')]"
-                      }
-                    },
-                    "PTR_roleAssignments": {
-                      "copy": {
-                        "name": "PTR_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/PTR/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "PTR"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed PTR record."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed PTR record."
-                      },
-                      "value": "[resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group of the deployed PTR record."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "privateDnsZone"
-              ]
-            },
-            "privateDnsZone_SOA": {
-              "copy": {
-                "name": "privateDnsZone_SOA",
-                "count": "[length(coalesce(parameters('soa'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-PrivateDnsZone-SOARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "privateDnsZoneName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(parameters('soa'), createArray())[copyIndex()].name]"
-                  },
-                  "metadata": {
-                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'metadata')]"
-                  },
-                  "soaRecord": {
-                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'soaRecord')]"
-                  },
-                  "ttl": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'ttl'), 3600)]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'roleAssignments')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.32.4.45862",
-                      "templateHash": "6653951445614700931"
-                    },
-                    "name": "Private DNS Zone SOA record",
-                    "description": "This module deploys a Private DNS Zone SOA record.",
-                    "owner": "Azure/module-maintainers"
-                  },
-                  "definitions": {
-                    "roleAssignmentType": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "name": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                            }
-                          },
-                          "roleDefinitionIdOrName": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                            }
-                          },
-                          "principalId": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                            }
-                          },
-                          "principalType": {
-                            "type": "string",
-                            "allowedValues": [
-                              "Device",
-                              "ForeignGroup",
-                              "Group",
-                              "ServicePrincipal",
-                              "User"
-                            ],
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The principal type of the assigned principal ID."
-                            }
-                          },
-                          "description": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The description of the role assignment."
-                            }
-                          },
-                          "condition": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                            }
-                          },
-                          "conditionVersion": {
-                            "type": "string",
-                            "allowedValues": [
-                              "2.0"
-                            ],
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. Version of the condition."
-                            }
-                          },
-                          "delegatedManagedIdentityResourceId": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The Resource Id of the delegated managed identity resource."
-                            }
-                          }
-                        }
-                      },
-                      "nullable": true
-                    }
-                  },
-                  "parameters": {
-                    "privateDnsZoneName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the SOA record."
-                      }
-                    },
-                    "metadata": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The metadata attached to the record set."
-                      }
-                    },
-                    "soaRecord": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. A SOA record."
-                      }
-                    },
-                    "ttl": {
-                      "type": "int",
-                      "defaultValue": 3600,
-                      "metadata": {
-                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
-                      }
-                    },
-                    "roleAssignments": {
-                      "$ref": "#/definitions/roleAssignmentType",
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "privateDnsZone": {
-                      "existing": true,
-                      "type": "Microsoft.Network/privateDnsZones",
-                      "apiVersion": "2020-06-01",
-                      "name": "[parameters('privateDnsZoneName')]"
-                    },
-                    "SOA": {
-                      "type": "Microsoft.Network/privateDnsZones/SOA",
-                      "apiVersion": "2020-06-01",
-                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "properties": {
-                        "metadata": "[parameters('metadata')]",
-                        "soaRecord": "[parameters('soaRecord')]",
-                        "ttl": "[parameters('ttl')]"
-                      }
-                    },
-                    "SOA_roleAssignments": {
-                      "copy": {
-                        "name": "SOA_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/SOA/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "SOA"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed SOA record."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed SOA record."
-                      },
-                      "value": "[resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group of the deployed SOA record."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "privateDnsZone"
-              ]
-            },
-            "privateDnsZone_SRV": {
-              "copy": {
-                "name": "privateDnsZone_SRV",
-                "count": "[length(coalesce(parameters('srv'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-PrivateDnsZone-SRVRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "privateDnsZoneName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(parameters('srv'), createArray())[copyIndex()].name]"
-                  },
-                  "metadata": {
-                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'metadata')]"
-                  },
-                  "srvRecords": {
-                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'srvRecords')]"
-                  },
-                  "ttl": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'ttl'), 3600)]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'roleAssignments')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.32.4.45862",
-                      "templateHash": "5790774778713328446"
-                    },
-                    "name": "Private DNS Zone SRV record",
-                    "description": "This module deploys a Private DNS Zone SRV record.",
-                    "owner": "Azure/module-maintainers"
-                  },
-                  "definitions": {
-                    "roleAssignmentType": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "name": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                            }
-                          },
-                          "roleDefinitionIdOrName": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                            }
-                          },
-                          "principalId": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                            }
-                          },
-                          "principalType": {
-                            "type": "string",
-                            "allowedValues": [
-                              "Device",
-                              "ForeignGroup",
-                              "Group",
-                              "ServicePrincipal",
-                              "User"
-                            ],
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The principal type of the assigned principal ID."
-                            }
-                          },
-                          "description": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The description of the role assignment."
-                            }
-                          },
-                          "condition": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                            }
-                          },
-                          "conditionVersion": {
-                            "type": "string",
-                            "allowedValues": [
-                              "2.0"
-                            ],
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. Version of the condition."
-                            }
-                          },
-                          "delegatedManagedIdentityResourceId": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The Resource Id of the delegated managed identity resource."
-                            }
-                          }
-                        }
-                      },
-                      "nullable": true
-                    }
-                  },
-                  "parameters": {
-                    "privateDnsZoneName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the SRV record."
-                      }
-                    },
-                    "metadata": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The metadata attached to the record set."
-                      }
-                    },
-                    "srvRecords": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The list of SRV records in the record set."
-                      }
-                    },
-                    "ttl": {
-                      "type": "int",
-                      "defaultValue": 3600,
-                      "metadata": {
-                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
-                      }
-                    },
-                    "roleAssignments": {
-                      "$ref": "#/definitions/roleAssignmentType",
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "privateDnsZone": {
-                      "existing": true,
-                      "type": "Microsoft.Network/privateDnsZones",
-                      "apiVersion": "2020-06-01",
-                      "name": "[parameters('privateDnsZoneName')]"
-                    },
-                    "SRV": {
-                      "type": "Microsoft.Network/privateDnsZones/SRV",
-                      "apiVersion": "2020-06-01",
-                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "properties": {
-                        "metadata": "[parameters('metadata')]",
-                        "srvRecords": "[parameters('srvRecords')]",
-                        "ttl": "[parameters('ttl')]"
-                      }
-                    },
-                    "SRV_roleAssignments": {
-                      "copy": {
-                        "name": "SRV_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/SRV/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "SRV"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed SRV record."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed SRV record."
-                      },
-                      "value": "[resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group of the deployed SRV record."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "privateDnsZone"
-              ]
-            },
-            "privateDnsZone_TXT": {
-              "copy": {
-                "name": "privateDnsZone_TXT",
-                "count": "[length(coalesce(parameters('txt'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-PrivateDnsZone-TXTRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "privateDnsZoneName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(parameters('txt'), createArray())[copyIndex()].name]"
-                  },
-                  "metadata": {
-                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'metadata')]"
-                  },
-                  "txtRecords": {
-                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'txtRecords')]"
-                  },
-                  "ttl": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'ttl'), 3600)]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'roleAssignments')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.32.4.45862",
-                      "templateHash": "1855369119498044639"
-                    },
-                    "name": "Private DNS Zone TXT record",
-                    "description": "This module deploys a Private DNS Zone TXT record.",
-                    "owner": "Azure/module-maintainers"
-                  },
-                  "definitions": {
-                    "roleAssignmentType": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "name": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                            }
-                          },
-                          "roleDefinitionIdOrName": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                            }
-                          },
-                          "principalId": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                            }
-                          },
-                          "principalType": {
-                            "type": "string",
-                            "allowedValues": [
-                              "Device",
-                              "ForeignGroup",
-                              "Group",
-                              "ServicePrincipal",
-                              "User"
-                            ],
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The principal type of the assigned principal ID."
-                            }
-                          },
-                          "description": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The description of the role assignment."
-                            }
-                          },
-                          "condition": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                            }
-                          },
-                          "conditionVersion": {
-                            "type": "string",
-                            "allowedValues": [
-                              "2.0"
-                            ],
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. Version of the condition."
-                            }
-                          },
-                          "delegatedManagedIdentityResourceId": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The Resource Id of the delegated managed identity resource."
-                            }
-                          }
-                        }
-                      },
-                      "nullable": true
-                    }
-                  },
-                  "parameters": {
-                    "privateDnsZoneName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the TXT record."
-                      }
-                    },
-                    "metadata": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The metadata attached to the record set."
-                      }
-                    },
-                    "ttl": {
-                      "type": "int",
-                      "defaultValue": 3600,
-                      "metadata": {
-                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
-                      }
-                    },
-                    "txtRecords": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The list of TXT records in the record set."
-                      }
-                    },
-                    "roleAssignments": {
-                      "$ref": "#/definitions/roleAssignmentType",
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "privateDnsZone": {
-                      "existing": true,
-                      "type": "Microsoft.Network/privateDnsZones",
-                      "apiVersion": "2020-06-01",
-                      "name": "[parameters('privateDnsZoneName')]"
-                    },
-                    "TXT": {
-                      "type": "Microsoft.Network/privateDnsZones/TXT",
-                      "apiVersion": "2020-06-01",
-                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "properties": {
-                        "metadata": "[parameters('metadata')]",
-                        "ttl": "[parameters('ttl')]",
-                        "txtRecords": "[parameters('txtRecords')]"
-                      }
-                    },
-                    "TXT_roleAssignments": {
-                      "copy": {
-                        "name": "TXT_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/TXT/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "TXT"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed TXT record."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed TXT record."
-                      },
-                      "value": "[resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group of the deployed TXT record."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "privateDnsZone"
-              ]
-            },
-            "privateDnsZone_virtualNetworkLinks": {
-              "copy": {
-                "name": "privateDnsZone_virtualNetworkLinks",
-                "count": "[length(coalesce(parameters('virtualNetworkLinks'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-PrivateDnsZone-VirtualNetworkLink-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "privateDnsZoneName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'name'), format('{0}-vnetlink', last(split(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()].virtualNetworkResourceId, '/'))))]"
-                  },
-                  "virtualNetworkResourceId": {
-                    "value": "[coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()].virtualNetworkResourceId]"
-                  },
-                  "location": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'location'), 'global')]"
-                  },
-                  "registrationEnabled": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'registrationEnabled'), false())]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                  },
-                  "resolutionPolicy": {
-                    "value": "[tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'resolutionPolicy')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.32.4.45862",
-                      "templateHash": "15326596012552051215"
-                    },
-                    "name": "Private DNS Zone Virtual Network Link",
-                    "description": "This module deploys a Private DNS Zone Virtual Network Link.",
-                    "owner": "Azure/module-maintainers"
-                  },
-                  "parameters": {
-                    "privateDnsZoneName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "defaultValue": "[format('{0}-vnetlink', last(split(parameters('virtualNetworkResourceId'), '/')))]",
-                      "metadata": {
-                        "description": "Optional. The name of the virtual network link."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "global",
-                      "metadata": {
-                        "description": "Optional. The location of the PrivateDNSZone. Should be global."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the resource."
-                      }
-                    },
-                    "registrationEnabled": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Is auto-registration of virtual machine records in the virtual network in the Private DNS zone enabled?."
-                      }
-                    },
-                    "virtualNetworkResourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Link to another virtual network resource ID."
-                      }
-                    },
-                    "resolutionPolicy": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The resolution policy on the virtual network link. Only applicable for virtual network links to privatelink zones, and for A,AAAA,CNAME queries. When set to `NxDomainRedirect`, Azure DNS resolver falls back to public resolution if private dns query resolution results in non-existent domain response. `Default` is configured as the default option."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "privateDnsZone": {
-                      "existing": true,
-                      "type": "Microsoft.Network/privateDnsZones",
-                      "apiVersion": "2020-06-01",
-                      "name": "[parameters('privateDnsZoneName')]"
-                    },
-                    "virtualNetworkLink": {
-                      "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
-                      "apiVersion": "2024-06-01",
-                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "registrationEnabled": "[parameters('registrationEnabled')]",
-                        "virtualNetwork": {
-                          "id": "[parameters('virtualNetworkResourceId')]"
-                        },
-                        "resolutionPolicy": "[parameters('resolutionPolicy')]"
-                      }
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed virtual network link."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed virtual network link."
-                      },
-                      "value": "[resourceId('Microsoft.Network/privateDnsZones/virtualNetworkLinks', parameters('privateDnsZoneName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group of the deployed virtual network link."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('virtualNetworkLink', '2024-06-01', 'full').location]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "privateDnsZone"
-              ]
-            }
-          },
-          "outputs": {
-            "resourceGroupName": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource group the private DNS zone was deployed into."
-              },
-              "value": "[resourceGroup().name]"
-            },
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the private DNS zone."
-              },
-              "value": "[parameters('name')]"
-            },
-            "resourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource ID of the private DNS zone."
-              },
-              "value": "[resourceId('Microsoft.Network/privateDnsZones', parameters('name'))]"
-            },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "The location the resource was deployed into."
-              },
-              "value": "[reference('privateDnsZone', '2020-06-01', 'full').location]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "virtualNetwork"
-      ]
-    },
-    "cosmosDb": {
-      "condition": "[variables('cosmosDbAccountEnabled')]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2022-09-01",
-      "name": "[take(format('avm.res.document-db.database-account.{0}', variables('cosmosDbResourceName')), 64)]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[coalesce(tryGet(parameters('cosmosDbAccountConfiguration'), 'name'), format('cosmos-{0}', parameters('solutionPrefix')))]"
-          },
-          "location": {
-            "value": "[coalesce(tryGet(parameters('cosmosDbAccountConfiguration'), 'location'), parameters('solutionLocation'))]"
-          },
-          "tags": {
-            "value": "[coalesce(tryGet(parameters('cosmosDbAccountConfiguration'), 'tags'), parameters('tags'))]"
-          },
-          "enableTelemetry": {
-            "value": "[parameters('enableTelemetry')]"
-          },
-          "diagnosticSettings": {
-            "value": [
-              {
-                "workspaceResourceId": "[if(variables('useExistingWorkspace'), variables('existingWorkspaceResourceId'), listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId)]"
-              }
-            ]
-          },
-          "databaseAccountOfferType": {
-            "value": "Standard"
-          },
-          "enableFreeTier": {
-            "value": false
-          },
-          "networkRestrictions": {
-            "value": {
-              "networkAclBypass": "None",
-              "publicNetworkAccess": "[if(variables('virtualNetworkEnabled'), 'Disabled', 'Enabled')]"
-            }
-          },
-          "privateEndpoints": "[if(variables('virtualNetworkEnabled'), createObject('value', createArray(createObject('name', format('pep-{0}', variables('cosmosDbResourceName')), 'customNetworkInterfaceName', format('nic-{0}', variables('cosmosDbResourceName')), 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', reference('privateDnsZonesCosmosDb').outputs.resourceId.value))), 'service', 'Sql', 'subnetResourceId', coalesce(tryGet(parameters('cosmosDbAccountConfiguration'), 'subnetResourceId'), reference('virtualNetwork').outputs.subnetResourceIds.value[0])))), createObject('value', createArray()))]",
-          "sqlDatabases": {
-            "value": "[concat(coalesce(tryGet(parameters('cosmosDbAccountConfiguration'), 'sqlDatabases'), createArray()), createArray(createObject('name', variables('cosmosDbDatabaseName'), 'containers', createArray(createObject('name', variables('cosmosDbDatabaseMemoryContainerName'), 'paths', createArray('/session_id'), 'kind', 'Hash', 'version', 2)))))]"
-          },
-          "locations": {
-            "value": [
-              {
-                "locationName": "[coalesce(tryGet(parameters('cosmosDbAccountConfiguration'), 'location'), parameters('solutionLocation'))]",
-                "failoverPriority": 0,
-                "isZoneRedundant": false
-              }
-            ]
-          },
-          "capabilitiesToAdd": {
-            "value": [
-              "EnableServerless"
-            ]
-          },
-          "sqlRoleAssignmentsPrincipalIds": {
-            "value": [
-              "[tryGet(tryGet(reference('containerApp').outputs, 'systemAssignedMIPrincipalId'), 'value')]"
-            ]
-          },
-          "sqlRoleDefinitions": {
-            "value": [
-              {
-                "roleType": "CustomRole",
-                "roleName": "Cosmos DB SQL Data Contributor",
-                "name": "cosmos-db-sql-data-contributor",
-                "dataAction": [
-                  "Microsoft.DocumentDB/databaseAccounts/readMetadata",
-                  "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/*",
-                  "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/*"
-                ]
-              }
-            ]
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.34.44.8038",
-              "templateHash": "4234855794516527664"
-            },
-            "name": "DocumentDB Database Accounts",
-            "description": "This module deploys a DocumentDB Database Account."
-          },
-          "definitions": {
-            "privateEndpointOutputType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "The name of the private endpoint."
-                  }
-                },
-                "resourceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "The resource ID of the private endpoint."
-                  }
-                },
-                "groupId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "The group Id for the private endpoint Group."
-                  }
-                },
-                "customDnsConfigs": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "fqdn": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "FQDN that resolves to private endpoint IP address."
-                        }
-                      },
-                      "ipAddresses": {
-                        "type": "array",
-                        "items": {
-                          "type": "string"
-                        },
-                        "metadata": {
-                          "description": "A list of private IP addresses of the private endpoint."
-                        }
-                      }
-                    }
-                  },
-                  "metadata": {
-                    "description": "The custom DNS configurations of the private endpoint."
-                  }
-                },
-                "networkInterfaceResourceIds": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "metadata": {
-                    "description": "The IDs of the network interfaces associated with the private endpoint."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for the private endpoint output."
-              }
-            },
-            "failoverLocationType": {
-              "type": "object",
-              "properties": {
-                "failoverPriority": {
-                  "type": "int",
-                  "metadata": {
-                    "description": "Required. The failover priority of the region. A failover priority of 0 indicates a write region. The maximum value for a failover priority = (total number of regions - 1). Failover priority values must be unique for each of the regions in which the database account exists."
-                  }
-                },
-                "isZoneRedundant": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Default to true. Flag to indicate whether or not this region is an AvailabilityZone region."
-                  }
-                },
-                "locationName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the region."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for the failover location."
-              }
-            },
-            "sqlRoleDefinitionType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Name of the SQL Role Definition."
-                  }
-                },
-                "dataAction": {
-                  "type": "array",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. An array of data actions that are allowed."
-                  }
-                },
-                "roleName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. A user-friendly name for the Role Definition. Must be unique for the database account."
-                  }
-                },
-                "roleType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "BuiltInRole",
-                    "CustomRole"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Indicates whether the Role Definition was built-in or user created."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for the SQL Role Definitions."
-              }
-            },
-            "sqlDatabaseType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Name of the SQL database ."
-                  }
-                },
-                "throughput": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Default to 400. Request units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
-                  }
-                },
-                "autoscaleSettingsMaxThroughput": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
-                  }
-                },
-                "containers": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "name": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. Name of the container."
-                        }
-                      },
-                      "paths": {
-                        "type": "array",
-                        "items": {
-                          "type": "string"
-                        },
-                        "minLength": 1,
-                        "maxLength": 3,
-                        "metadata": {
-                          "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1."
-                        }
-                      },
-                      "analyticalStorageTtl": {
-                        "type": "int",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store."
-                        }
-                      },
-                      "autoscaleSettingsMaxThroughput": {
-                        "type": "int",
-                        "nullable": true,
-                        "maxValue": 1000000,
-                        "metadata": {
-                          "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level."
-                        }
-                      },
-                      "conflictResolutionPolicy": {
-                        "type": "object",
-                        "properties": {
-                          "conflictResolutionPath": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Conditional. The conflict resolution path in the case of LastWriterWins mode. Required if `mode` is set to 'LastWriterWins'."
-                            }
-                          },
-                          "conflictResolutionProcedure": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Conditional. The procedure to resolve conflicts in the case of custom mode. Required if `mode` is set to 'Custom'."
-                            }
-                          },
-                          "mode": {
-                            "type": "string",
-                            "allowedValues": [
-                              "Custom",
-                              "LastWriterWins"
-                            ],
-                            "metadata": {
-                              "description": "Required. Indicates the conflict resolution mode."
-                            }
-                          }
-                        },
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions."
-                        }
-                      },
-                      "defaultTtl": {
-                        "type": "int",
-                        "nullable": true,
-                        "minValue": -1,
-                        "maxValue": 2147483647,
-                        "metadata": {
-                          "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default."
-                        }
-                      },
-                      "indexingPolicy": {
-                        "type": "object",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Indexing policy of the container."
-                        }
-                      },
-                      "kind": {
-                        "type": "string",
-                        "allowedValues": [
-                          "Hash",
-                          "MultiHash"
-                        ],
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning."
-                        }
-                      },
-                      "version": {
-                        "type": "int",
-                        "allowedValues": [
-                          1,
-                          2
-                        ],
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition."
-                        }
-                      },
-                      "throughput": {
-                        "type": "int",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used."
-                        }
-                      },
-                      "uniqueKeyPolicyKeys": {
-                        "type": "array",
-                        "items": {
-                          "type": "object",
-                          "properties": {
-                            "paths": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "metadata": {
-                                "description": "Required. List of paths must be unique for each document in the Azure Cosmos DB service."
-                              }
-                            }
-                          }
-                        },
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Array of containers to deploy in the SQL database."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for the SQL database."
-              }
-            },
-            "secretsExportConfigurationType": {
-              "type": "object",
-              "properties": {
-                "keyVaultResourceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The resource ID of the key vault where to store the secrets of this module."
-                  }
-                },
-                "primaryWriteKeySecretName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The primary write key secret name to create."
-                  }
-                },
-                "primaryReadOnlyKeySecretName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The primary readonly key secret name to create."
-                  }
-                },
-                "primaryWriteConnectionStringSecretName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The primary write connection string secret name to create."
-                  }
-                },
-                "primaryReadonlyConnectionStringSecretName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The primary readonly connection string secret name to create."
-                  }
-                },
-                "secondaryWriteKeySecretName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The primary write key secret name to create."
-                  }
-                },
-                "secondaryReadonlyKeySecretName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The primary readonly key secret name to create."
-                  }
-                },
-                "secondaryWriteConnectionStringSecretName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The primary write connection string secret name to create."
-                  }
-                },
-                "secondaryReadonlyConnectionStringSecretName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The primary readonly connection string secret name to create."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for the secrets export configuration."
-              }
-            },
-            "secretsOutputType": {
-              "type": "object",
-              "properties": {},
-              "additionalProperties": {
-                "$ref": "#/definitions/secretSetType",
-                "metadata": {
-                  "description": "An exported secret's references."
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for the secrets output."
-              }
-            },
-            "networkRestrictionType": {
-              "type": "object",
-              "properties": {
-                "ipRules": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. A single IPv4 address or a single IPv4 address range in CIDR format. Provided IPs must be well-formatted and cannot be contained in one of the following ranges: 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, since these are not enforceable by the IP address filter. Example of valid inputs: \"23.40.210.245\" or \"23.40.210.0/8\"."
-                  }
-                },
-                "networkAclBypass": {
-                  "type": "string",
-                  "allowedValues": [
-                    "AzureServices",
-                    "None"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Default to None. Specifies the network ACL bypass for Azure services."
-                  }
-                },
-                "publicNetworkAccess": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Disabled",
-                    "Enabled"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Default to Disabled. Whether requests from Public Network are allowed."
-                  }
-                },
-                "virtualNetworkRules": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "subnetResourceId": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. Resource ID of a subnet."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. List of Virtual Network ACL rules configured for the Cosmos DB account.."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for the network restriction."
-              }
-            },
-            "_1.privateEndpointCustomDnsConfigType": {
-              "type": "object",
-              "properties": {
-                "fqdn": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. FQDN that resolves to private endpoint IP address."
-                  }
-                },
-                "ipAddresses": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "metadata": {
-                    "description": "Required. A list of private IP addresses of the private endpoint."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "_1.privateEndpointIpConfigurationType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the resource that is unique within a resource group."
-                  }
-                },
-                "properties": {
-                  "type": "object",
-                  "properties": {
-                    "groupId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                      }
-                    },
-                    "memberName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
-                      }
-                    },
-                    "privateIPAddress": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                      }
-                    }
-                  },
-                  "metadata": {
-                    "description": "Required. Properties of private endpoint IP configurations."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "_1.privateEndpointPrivateDnsZoneGroupType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the Private DNS Zone Group."
-                  }
-                },
-                "privateDnsZoneGroupConfigs": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "name": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. The name of the private DNS Zone Group config."
-                        }
-                      },
-                      "privateDnsZoneResourceId": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. The resource id of the private DNS zone."
-                        }
-                      }
-                    }
-                  },
-                  "metadata": {
-                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "diagnosticSettingFullType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the diagnostic setting."
-                  }
-                },
-                "logCategoriesAndGroups": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                        }
-                      },
-                      "categoryGroup": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                        }
-                      },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                  }
-                },
-                "metricCategories": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                        }
-                      },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                  }
-                },
-                "logAnalyticsDestinationType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "AzureDiagnostics",
-                    "Dedicated"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                  }
-                },
-                "workspaceResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "storageAccountResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "eventHubAuthorizationRuleResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                  }
-                },
-                "eventHubName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "marketplacePartnerResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "lockType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of lock."
-                  }
-                },
-                "kind": {
-                  "type": "string",
-                  "allowedValues": [
-                    "CanNotDelete",
-                    "None",
-                    "ReadOnly"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a lock.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "managedIdentityAllType": {
-              "type": "object",
-              "properties": {
-                "systemAssigned": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Enables system assigned managed identity on the resource."
-                  }
-                },
-                "userAssignedResourceIds": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "privateEndpointMultiServiceType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the private endpoint."
-                  }
-                },
-                "location": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The location to deploy the private endpoint to."
-                  }
-                },
-                "privateLinkServiceConnectionName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the private link connection to create."
-                  }
-                },
-                "service": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\" for a Storage Account's Private Endpoints."
-                  }
-                },
-                "subnetResourceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                  }
-                },
-                "resourceGroupResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
-                  }
-                },
-                "privateDnsZoneGroup": {
-                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The private DNS zone group to configure for the private endpoint."
-                  }
-                },
-                "isManualConnection": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. If Manual Private Link Connection is required."
-                  }
-                },
-                "manualConnectionRequestMessage": {
-                  "type": "string",
-                  "nullable": true,
-                  "maxLength": 140,
-                  "metadata": {
-                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
-                  }
-                },
-                "customDnsConfigs": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Custom DNS configurations."
-                  }
-                },
-                "ipConfigurations": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
-                  }
-                },
-                "applicationSecurityGroupResourceIds": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
-                  }
-                },
-                "customNetworkInterfaceName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                  }
-                },
-                "lock": {
-                  "$ref": "#/definitions/lockType",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                },
-                "roleAssignments": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/roleAssignmentType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Array of role assignments to create."
-                  }
-                },
-                "tags": {
-                  "type": "object",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
-                  }
-                },
-                "enableTelemetry": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Enable/Disable usage telemetry for module."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can NOT be assumed (i.e., for services that have more than one subresource, like Storage Account with Blob (blob, table, queue, file, ...).",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "roleAssignmentType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                  }
-                },
-                "roleDefinitionIdOrName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                  }
-                },
-                "principalId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                  }
-                },
-                "principalType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Device",
-                    "ForeignGroup",
-                    "Group",
-                    "ServicePrincipal",
-                    "User"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The principal type of the assigned principal ID."
-                  }
-                },
-                "description": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The description of the role assignment."
-                  }
-                },
-                "condition": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                  }
-                },
-                "conditionVersion": {
-                  "type": "string",
-                  "allowedValues": [
-                    "2.0"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Version of the condition."
-                  }
-                },
-                "delegatedManagedIdentityResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a role assignment.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "secretSetType": {
-              "type": "object",
-              "properties": {
-                "secretResourceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "The resourceId of the exported secret."
-                  }
-                },
-                "secretUri": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "The secret URI of the exported secret."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "The type for the secret set.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "modules/keyVaultExport.bicep"
-                }
-              }
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. Name of the Database Account."
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional. Default to current resource group scope location. Location for all resources."
-              }
-            },
-            "tags": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Tags of the Database Account resource."
-              }
-            },
-            "managedIdentities": {
-              "$ref": "#/definitions/managedIdentityAllType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The managed identity definition for this resource."
-              }
-            },
-            "databaseAccountOfferType": {
-              "type": "string",
-              "defaultValue": "Standard",
-              "allowedValues": [
-                "Standard"
-              ],
-              "metadata": {
-                "description": "Optional. Default to Standard. The offer type for the Azure Cosmos DB database account."
-              }
-            },
-            "locations": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/failoverLocationType"
-              },
-              "defaultValue": [],
-              "metadata": {
-                "description": "Optional. Default to the location where the account is deployed. Locations enabled for the Cosmos DB account."
-              }
-            },
-            "defaultConsistencyLevel": {
-              "type": "string",
-              "defaultValue": "Session",
-              "allowedValues": [
-                "Eventual",
-                "ConsistentPrefix",
-                "Session",
-                "BoundedStaleness",
-                "Strong"
-              ],
-              "metadata": {
-                "description": "Optional. Default to Session. The default consistency level of the Cosmos DB account."
-              }
-            },
-            "disableLocalAuth": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Default to true. Opt-out of local authentication and ensure only MSI and AAD can be used exclusively for authentication."
-              }
-            },
-            "enableAnalyticalStorage": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Default to false. Flag to indicate whether to enable storage analytics."
-              }
-            },
-            "automaticFailover": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Default to true. Enable automatic failover for regions."
-              }
-            },
-            "enableFreeTier": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Default to false. Flag to indicate whether Free Tier is enabled."
-              }
-            },
-            "enableMultipleWriteLocations": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Default to false. Enables the account to write in multiple locations. Periodic backup must be used if enabled."
-              }
-            },
-            "disableKeyBasedMetadataWriteAccess": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Default to true. Disable write operations on metadata resources (databases, containers, throughput) via account keys."
-              }
-            },
-            "maxStalenessPrefix": {
-              "type": "int",
-              "defaultValue": 100000,
-              "minValue": 1,
-              "maxValue": 2147483647,
-              "metadata": {
-                "description": "Optional. Default to 100000. Max stale requests. Required for BoundedStaleness. Valid ranges, Single Region: 10 to 1000000. Multi Region: 100000 to 1000000."
-              }
-            },
-            "maxIntervalInSeconds": {
-              "type": "int",
-              "defaultValue": 300,
-              "minValue": 5,
-              "maxValue": 86400,
-              "metadata": {
-                "description": "Optional. Default to 300. Max lag time (minutes). Required for BoundedStaleness. Valid ranges, Single Region: 5 to 84600. Multi Region: 300 to 86400."
-              }
-            },
-            "serverVersion": {
-              "type": "string",
-              "defaultValue": "4.2",
-              "allowedValues": [
-                "3.2",
-                "3.6",
-                "4.0",
-                "4.2",
-                "5.0",
-                "6.0",
-                "7.0"
-              ],
-              "metadata": {
-                "description": "Optional. Default to 4.2. Specifies the MongoDB server version to use."
-              }
-            },
-            "sqlDatabases": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/sqlDatabaseType"
-              },
-              "defaultValue": [],
-              "metadata": {
-                "description": "Optional. SQL Databases configurations."
-              }
-            },
-            "sqlRoleAssignmentsPrincipalIds": {
-              "type": "array",
-              "defaultValue": [],
-              "metadata": {
-                "description": "Optional. SQL Role Definitions configurations."
-              }
-            },
-            "sqlRoleDefinitions": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/sqlRoleDefinitionType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. SQL Role Definitions configurations."
-              }
-            },
-            "mongodbDatabases": {
-              "type": "array",
-              "defaultValue": [],
-              "metadata": {
-                "description": "Optional. MongoDB Databases configurations."
-              }
-            },
-            "gremlinDatabases": {
-              "type": "array",
-              "defaultValue": [],
-              "metadata": {
-                "description": "Optional. Gremlin Databases configurations."
-              }
-            },
-            "tables": {
-              "type": "array",
-              "defaultValue": [],
-              "metadata": {
-                "description": "Optional. Table configurations."
-              }
-            },
-            "enableTelemetry": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Enable/Disable usage telemetry for module."
-              }
-            },
-            "totalThroughputLimit": {
-              "type": "int",
-              "defaultValue": -1,
-              "metadata": {
-                "description": "Optional. Default to unlimited. The total throughput limit imposed on this Cosmos DB account (RU/s)."
-              }
-            },
-            "lock": {
-              "$ref": "#/definitions/lockType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The lock settings of the service."
-              }
-            },
-            "roleAssignments": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/roleAssignmentType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of role assignments to create."
-              }
-            },
-            "diagnosticSettings": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/diagnosticSettingFullType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The diagnostic settings of the service."
-              }
-            },
-            "capabilitiesToAdd": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              },
-              "defaultValue": [],
-              "allowedValues": [
-                "EnableCassandra",
-                "EnableTable",
-                "EnableGremlin",
-                "EnableMongo",
-                "DisableRateLimitingResponses",
-                "EnableServerless",
-                "EnableNoSQLVectorSearch",
-                "EnableNoSQLFullTextSearch",
-                "EnableMaterializedViews",
-                "DeleteAllItemsByPartitionKey"
-              ],
-              "metadata": {
-                "description": "Optional. List of Cosmos DB capabilities for the account. THE DeleteAllItemsByPartitionKey VALUE USED IN THIS PARAMETER IS USED FOR A PREVIEW SERVICE/FEATURE, MICROSOFT MAY NOT PROVIDE SUPPORT FOR THIS, PLEASE CHECK THE PRODUCT DOCS FOR CLARIFICATION."
-              }
-            },
-            "backupPolicyType": {
-              "type": "string",
-              "defaultValue": "Continuous",
-              "allowedValues": [
-                "Periodic",
-                "Continuous"
-              ],
-              "metadata": {
-                "description": "Optional. Default to Continuous. Describes the mode of backups. Periodic backup must be used if multiple write locations are used."
-              }
-            },
-            "backupPolicyContinuousTier": {
-              "type": "string",
-              "defaultValue": "Continuous30Days",
-              "allowedValues": [
-                "Continuous30Days",
-                "Continuous7Days"
-              ],
-              "metadata": {
-                "description": "Optional. Default to Continuous30Days. Configuration values for continuous mode backup."
-              }
-            },
-            "backupIntervalInMinutes": {
-              "type": "int",
-              "defaultValue": 240,
-              "minValue": 60,
-              "maxValue": 1440,
-              "metadata": {
-                "description": "Optional. Default to 240. An integer representing the interval in minutes between two backups. Only applies to periodic backup type."
-              }
-            },
-            "backupRetentionIntervalInHours": {
-              "type": "int",
-              "defaultValue": 8,
-              "minValue": 2,
-              "maxValue": 720,
-              "metadata": {
-                "description": "Optional. Default to 8. An integer representing the time (in hours) that each backup is retained. Only applies to periodic backup type."
-              }
-            },
-            "backupStorageRedundancy": {
-              "type": "string",
-              "defaultValue": "Local",
-              "allowedValues": [
-                "Geo",
-                "Local",
-                "Zone"
-              ],
-              "metadata": {
-                "description": "Optional. Default to Local. Enum to indicate type of backup residency. Only applies to periodic backup type."
-              }
-            },
-            "privateEndpoints": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/privateEndpointMultiServiceType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
-              }
-            },
-            "secretsExportConfiguration": {
-              "$ref": "#/definitions/secretsExportConfigurationType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Key vault reference and secret settings for the module's secrets export."
-              }
-            },
-            "networkRestrictions": {
-              "$ref": "#/definitions/networkRestrictionType",
-              "defaultValue": {
-                "ipRules": [],
-                "virtualNetworkRules": [],
-                "publicNetworkAccess": "Disabled"
-              },
-              "metadata": {
-                "description": "Optional. The network configuration of this module. Defaults to `{ ipRules: [], virtualNetworkRules: [], publicNetworkAccess: 'Disabled' }`."
-              }
-            },
-            "minimumTlsVersion": {
-              "type": "string",
-              "defaultValue": "Tls12",
-              "allowedValues": [
-                "Tls12"
-              ],
-              "metadata": {
-                "description": "Optional. Default to TLS 1.2. Enum to indicate the minimum allowed TLS version. Azure Cosmos DB for MongoDB RU and Apache Cassandra only work with TLS 1.2 or later."
-              }
-            }
-          },
-          "variables": {
-            "copy": [
-              {
-                "name": "databaseAccount_locations",
-                "count": "[length(parameters('locations'))]",
-                "input": {
-                  "failoverPriority": "[parameters('locations')[copyIndex('databaseAccount_locations')].failoverPriority]",
-                  "locationName": "[parameters('locations')[copyIndex('databaseAccount_locations')].locationName]",
-                  "isZoneRedundant": "[coalesce(tryGet(parameters('locations')[copyIndex('databaseAccount_locations')], 'isZoneRedundant'), true())]"
-                }
-              },
-              {
-                "name": "capabilities",
-                "count": "[length(parameters('capabilitiesToAdd'))]",
-                "input": {
-                  "name": "[parameters('capabilitiesToAdd')[copyIndex('capabilities')]]"
-                }
-              },
-              {
-                "name": "ipRules",
-                "count": "[length(coalesce(tryGet(parameters('networkRestrictions'), 'ipRules'), createArray()))]",
-                "input": {
-                  "ipAddressOrRange": "[coalesce(tryGet(parameters('networkRestrictions'), 'ipRules'), createArray())[copyIndex('ipRules')]]"
-                }
-              },
-              {
-                "name": "virtualNetworkRules",
-                "count": "[length(coalesce(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules'), createArray()))]",
-                "input": {
-                  "id": "[coalesce(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules'), createArray())[copyIndex('virtualNetworkRules')].subnetResourceId]",
-                  "ignoreMissingVnetServiceEndpoint": false
-                }
-              },
-              {
-                "name": "formattedRoleAssignments",
-                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-              }
-            ],
-            "enableReferencedModulesTelemetry": false,
-            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
-            "consistencyPolicy": {
-              "Eventual": {
-                "defaultConsistencyLevel": "Eventual"
-              },
-              "ConsistentPrefix": {
-                "defaultConsistencyLevel": "ConsistentPrefix"
-              },
-              "Session": {
-                "defaultConsistencyLevel": "Session"
-              },
-              "BoundedStaleness": {
-                "defaultConsistencyLevel": "BoundedStaleness",
-                "maxStalenessPrefix": "[parameters('maxStalenessPrefix')]",
-                "maxIntervalInSeconds": "[parameters('maxIntervalInSeconds')]"
-              },
-              "Strong": {
-                "defaultConsistencyLevel": "Strong"
-              }
-            },
-            "defaultFailoverLocation": [
-              {
-                "failoverPriority": 0,
-                "locationName": "[parameters('location')]",
-                "isZoneRedundant": true
-              }
-            ],
-            "kind": "[if(or(not(empty(parameters('sqlDatabases'))), not(empty(parameters('gremlinDatabases')))), 'GlobalDocumentDB', if(not(empty(parameters('mongodbDatabases'))), 'MongoDB', 'GlobalDocumentDB'))]",
-            "backupPolicy": "[if(equals(parameters('backupPolicyType'), 'Continuous'), createObject('type', parameters('backupPolicyType'), 'continuousModeProperties', createObject('tier', parameters('backupPolicyContinuousTier'))), createObject('type', parameters('backupPolicyType'), 'periodicModeProperties', createObject('backupIntervalInMinutes', parameters('backupIntervalInMinutes'), 'backupRetentionIntervalInHours', parameters('backupRetentionIntervalInHours'), 'backupStorageRedundancy', parameters('backupStorageRedundancy'))))]",
-            "databaseAccountProperties": "[union(createObject('databaseAccountOfferType', parameters('databaseAccountOfferType'), 'backupPolicy', variables('backupPolicy'), 'capabilities', variables('capabilities'), 'minimalTlsVersion', parameters('minimumTlsVersion'), 'capacity', createObject('totalThroughputLimit', parameters('totalThroughputLimit'))), if(or(or(or(not(empty(parameters('sqlDatabases'))), not(empty(parameters('mongodbDatabases')))), not(empty(parameters('gremlinDatabases')))), not(empty(parameters('tables')))), createObject('consistencyPolicy', variables('consistencyPolicy')[parameters('defaultConsistencyLevel')], 'enableMultipleWriteLocations', parameters('enableMultipleWriteLocations'), 'locations', if(empty(variables('databaseAccount_locations')), variables('defaultFailoverLocation'), variables('databaseAccount_locations')), 'ipRules', variables('ipRules'), 'virtualNetworkRules', variables('virtualNetworkRules'), 'networkAclBypass', coalesce(tryGet(parameters('networkRestrictions'), 'networkAclBypass'), 'None'), 'publicNetworkAccess', coalesce(tryGet(parameters('networkRestrictions'), 'publicNetworkAccess'), 'Disabled'), 'isVirtualNetworkFilterEnabled', or(not(empty(variables('ipRules'))), not(empty(variables('virtualNetworkRules')))), 'enableFreeTier', parameters('enableFreeTier'), 'enableAutomaticFailover', parameters('automaticFailover'), 'enableAnalyticalStorage', parameters('enableAnalyticalStorage')), createObject()), if(or(not(empty(parameters('sqlDatabases'))), not(empty(parameters('tables')))), createObject('disableLocalAuth', parameters('disableLocalAuth'), 'disableKeyBasedMetadataWriteAccess', parameters('disableKeyBasedMetadataWriteAccess')), createObject()), if(not(empty(parameters('mongodbDatabases'))), createObject('apiProperties', createObject('serverVersion', parameters('serverVersion'))), createObject()))]",
-            "builtInRoleNames": {
-              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-              "Cosmos DB Account Reader Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fbdf93bf-df7d-467e-a4d2-9458aa1360c8')]",
-              "Cosmos DB Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa')]",
-              "CosmosBackupOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db7b14f2-5adf-42da-9f96-f2ee17bab5cb')]",
-              "CosmosRestoreOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5432c526-bc82-444a-b7ba-57c5b0b5b34f')]",
-              "DocumentDB Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5bd9cd88-fe45-4216-938b-f97437e15450')]",
-              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-            }
-          },
-          "resources": {
-            "avmTelemetry": {
-              "condition": "[parameters('enableTelemetry')]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2024-07-01",
-              "name": "[format('46d3xbcp.res.documentdb-databaseaccount.{0}.{1}', replace('0.12.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-              "properties": {
-                "mode": "Incremental",
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "resources": [],
-                  "outputs": {
-                    "telemetry": {
-                      "type": "String",
-                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                    }
-                  }
-                }
-              }
-            },
-            "databaseAccount": {
-              "type": "Microsoft.DocumentDB/databaseAccounts",
-              "apiVersion": "2024-11-15",
-              "name": "[parameters('name')]",
-              "location": "[parameters('location')]",
-              "tags": "[parameters('tags')]",
-              "identity": "[variables('identity')]",
-              "kind": "[variables('kind')]",
-              "properties": "[variables('databaseAccountProperties')]"
-            },
-            "databaseAccount_lock": {
-              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-              "type": "Microsoft.Authorization/locks",
-              "apiVersion": "2020-05-01",
-              "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-              "properties": {
-                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-              },
-              "dependsOn": [
-                "databaseAccount"
-              ]
-            },
-            "databaseAccount_diagnosticSettings": {
-              "copy": {
-                "name": "databaseAccount_diagnosticSettings",
-                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-              },
-              "type": "Microsoft.Insights/diagnosticSettings",
-              "apiVersion": "2021-05-01-preview",
-              "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-              "properties": {
-                "copy": [
-                  {
-                    "name": "metrics",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                    "input": {
-                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                      "timeGrain": null
-                    }
-                  },
-                  {
-                    "name": "logs",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                    "input": {
-                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                    }
-                  }
-                ],
-                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-              },
-              "dependsOn": [
-                "databaseAccount"
-              ]
-            },
-            "databaseAccount_roleAssignments": {
-              "copy": {
-                "name": "databaseAccount_roleAssignments",
-                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-              },
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-              "properties": {
-                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-              },
-              "dependsOn": [
-                "databaseAccount"
-              ]
-            },
-            "databaseAccount_sqlDatabases": {
-              "copy": {
-                "name": "databaseAccount_sqlDatabases",
-                "count": "[length(parameters('sqlDatabases'))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('location')), parameters('sqlDatabases')[copyIndex()].name)]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[parameters('sqlDatabases')[copyIndex()].name]"
-                  },
-                  "containers": {
-                    "value": "[tryGet(parameters('sqlDatabases')[copyIndex()], 'containers')]"
-                  },
-                  "throughput": {
-                    "value": "[tryGet(parameters('sqlDatabases')[copyIndex()], 'throughput')]"
-                  },
-                  "databaseAccountName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "autoscaleSettingsMaxThroughput": {
-                    "value": "[tryGet(parameters('sqlDatabases')[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "16080632612286518435"
-                    },
-                    "name": "DocumentDB Database Account SQL Databases",
-                    "description": "This module deploys a SQL Database in a CosmosDB Account."
-                  },
-                  "parameters": {
-                    "databaseAccountName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the SQL database ."
-                      }
-                    },
-                    "containers": {
-                      "type": "array",
-                      "items": {
-                        "type": "object"
-                      },
-                      "defaultValue": [],
-                      "metadata": {
-                        "description": "Optional. Array of containers to deploy in the SQL database."
-                      }
-                    },
-                    "throughput": {
-                      "type": "int",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Request units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
-                      }
-                    },
-                    "autoscaleSettingsMaxThroughput": {
-                      "type": "int",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the SQL database resource."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "databaseAccount": {
-                      "existing": true,
-                      "type": "Microsoft.DocumentDB/databaseAccounts",
-                      "apiVersion": "2024-11-15",
-                      "name": "[parameters('databaseAccountName')]"
-                    },
-                    "sqlDatabase": {
-                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases",
-                      "apiVersion": "2024-11-15",
-                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "resource": {
-                          "id": "[parameters('name')]"
-                        },
-                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(equals(parameters('autoscaleSettingsMaxThroughput'), null()), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]"
-                      },
-                      "dependsOn": [
-                        "databaseAccount"
-                      ]
-                    },
-                    "container": {
-                      "copy": {
-                        "name": "container",
-                        "count": "[length(parameters('containers'))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('name')), parameters('containers')[copyIndex()].name)]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "databaseAccountName": {
-                            "value": "[parameters('databaseAccountName')]"
-                          },
-                          "sqlDatabaseName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "name": {
-                            "value": "[parameters('containers')[copyIndex()].name]"
-                          },
-                          "analyticalStorageTtl": {
-                            "value": "[tryGet(parameters('containers')[copyIndex()], 'analyticalStorageTtl')]"
-                          },
-                          "autoscaleSettingsMaxThroughput": {
-                            "value": "[tryGet(parameters('containers')[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
-                          },
-                          "conflictResolutionPolicy": {
-                            "value": "[tryGet(parameters('containers')[copyIndex()], 'conflictResolutionPolicy')]"
-                          },
-                          "defaultTtl": {
-                            "value": "[tryGet(parameters('containers')[copyIndex()], 'defaultTtl')]"
-                          },
-                          "indexingPolicy": {
-                            "value": "[tryGet(parameters('containers')[copyIndex()], 'indexingPolicy')]"
-                          },
-                          "kind": {
-                            "value": "[tryGet(parameters('containers')[copyIndex()], 'kind')]"
-                          },
-                          "version": {
-                            "value": "[tryGet(parameters('containers')[copyIndex()], 'version')]"
-                          },
-                          "paths": {
-                            "value": "[tryGet(parameters('containers')[copyIndex()], 'paths')]"
-                          },
-                          "throughput": "[if(and(or(not(equals(parameters('throughput'), null())), not(equals(parameters('autoscaleSettingsMaxThroughput'), null()))), equals(tryGet(parameters('containers')[copyIndex()], 'throughput'), null())), createObject('value', -1), createObject('value', tryGet(parameters('containers')[copyIndex()], 'throughput')))]",
-                          "uniqueKeyPolicyKeys": {
-                            "value": "[tryGet(parameters('containers')[copyIndex()], 'uniqueKeyPolicyKeys')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.34.44.8038",
-                              "templateHash": "8834615293032195419"
-                            },
-                            "name": "DocumentDB Database Account SQL Database Containers",
-                            "description": "This module deploys a SQL Database Container in a CosmosDB Account."
-                          },
-                          "parameters": {
-                            "databaseAccountName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "sqlDatabaseName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent SQL Database. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the container."
-                              }
-                            },
-                            "analyticalStorageTtl": {
-                              "type": "int",
-                              "defaultValue": 0,
-                              "metadata": {
-                                "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store."
-                              }
-                            },
-                            "conflictResolutionPolicy": {
-                              "type": "object",
-                              "defaultValue": {},
-                              "metadata": {
-                                "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions."
-                              }
-                            },
-                            "defaultTtl": {
-                              "type": "int",
-                              "defaultValue": -1,
-                              "minValue": -1,
-                              "maxValue": 2147483647,
-                              "metadata": {
-                                "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default."
-                              }
-                            },
-                            "throughput": {
-                              "type": "int",
-                              "defaultValue": 400,
-                              "metadata": {
-                                "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
-                              }
-                            },
-                            "autoscaleSettingsMaxThroughput": {
-                              "type": "int",
-                              "nullable": true,
-                              "maxValue": 1000000,
-                              "metadata": {
-                                "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Tags of the SQL Database resource."
-                              }
-                            },
-                            "paths": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "minLength": 1,
-                              "maxLength": 3,
-                              "metadata": {
-                                "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1."
-                              }
-                            },
-                            "indexingPolicy": {
-                              "type": "object",
-                              "defaultValue": {},
-                              "metadata": {
-                                "description": "Optional. Indexing policy of the container."
-                              }
-                            },
-                            "uniqueKeyPolicyKeys": {
-                              "type": "array",
-                              "defaultValue": [],
-                              "metadata": {
-                                "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service."
-                              }
-                            },
-                            "kind": {
-                              "type": "string",
-                              "defaultValue": "Hash",
-                              "allowedValues": [
-                                "Hash",
-                                "MultiHash"
-                              ],
-                              "metadata": {
-                                "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning."
-                              }
-                            },
-                            "version": {
-                              "type": "int",
-                              "defaultValue": 1,
-                              "allowedValues": [
-                                1,
-                                2
-                              ],
-                              "metadata": {
-                                "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "copy": [
-                              {
-                                "name": "partitionKeyPaths",
-                                "count": "[length(parameters('paths'))]",
-                                "input": "[if(startsWith(parameters('paths')[copyIndex('partitionKeyPaths')], '/'), parameters('paths')[copyIndex('partitionKeyPaths')], format('/{0}', parameters('paths')[copyIndex('partitionKeyPaths')]))]"
-                              }
-                            ],
-                            "containerResourceParams": "[union(createObject('conflictResolutionPolicy', parameters('conflictResolutionPolicy'), 'defaultTtl', parameters('defaultTtl'), 'id', parameters('name'), 'indexingPolicy', if(not(empty(parameters('indexingPolicy'))), parameters('indexingPolicy'), null()), 'partitionKey', createObject('paths', variables('partitionKeyPaths'), 'kind', parameters('kind'), 'version', if(equals(parameters('kind'), 'MultiHash'), 2, parameters('version'))), 'uniqueKeyPolicy', if(not(empty(parameters('uniqueKeyPolicyKeys'))), createObject('uniqueKeys', parameters('uniqueKeyPolicyKeys')), null())), if(not(equals(parameters('analyticalStorageTtl'), 0)), createObject('analyticalStorageTtl', parameters('analyticalStorageTtl')), createObject()))]"
-                          },
-                          "resources": {
-                            "databaseAccount::sqlDatabase": {
-                              "existing": true,
-                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases",
-                              "apiVersion": "2024-11-15",
-                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('sqlDatabaseName'))]"
-                            },
-                            "databaseAccount": {
-                              "existing": true,
-                              "type": "Microsoft.DocumentDB/databaseAccounts",
-                              "apiVersion": "2024-11-15",
-                              "name": "[parameters('databaseAccountName')]"
-                            },
-                            "container": {
-                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers",
-                              "apiVersion": "2024-11-15",
-                              "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]",
-                              "tags": "[parameters('tags')]",
-                              "properties": {
-                                "resource": "[variables('containerResourceParams')]",
-                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(and(equals(parameters('autoscaleSettingsMaxThroughput'), null()), not(equals(parameters('throughput'), -1))), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]"
-                              },
-                              "dependsOn": [
-                                "databaseAccount"
-                              ]
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the container."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the container."
-                              },
-                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the resource group the container was created in."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "sqlDatabase"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the SQL database."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the SQL database."
-                      },
-                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', parameters('databaseAccountName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the resource group the SQL database was created in."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "databaseAccount"
-              ]
-            },
-            "databaseAccount_sqlRoleDefinitions": {
-              "copy": {
-                "name": "databaseAccount_sqlRoleDefinitions",
-                "count": "[length(coalesce(parameters('sqlRoleDefinitions'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-sqlrd-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()].name)]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()].name]"
-                  },
-                  "databaseAccountName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "dataActions": {
-                    "value": "[tryGet(coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()], 'dataActions')]"
-                  },
-                  "roleName": {
-                    "value": "[tryGet(coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()], 'roleName')]"
-                  },
-                  "roleType": {
-                    "value": "[tryGet(coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()], 'roleType')]"
-                  },
-                  "principalIds": {
-                    "value": "[parameters('sqlRoleAssignmentsPrincipalIds')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "2490416937519336508"
-                    },
-                    "name": "DocumentDB Database Account SQL Role.",
-                    "description": "This module deploys SQL Role Definision and Assignment in a CosmosDB Account."
-                  },
-                  "parameters": {
-                    "databaseAccountName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the SQL Role."
-                      }
-                    },
-                    "dataActions": {
-                      "type": "array",
-                      "defaultValue": [
-                        "Microsoft.DocumentDB/databaseAccounts/readMetadata",
-                        "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/*",
-                        "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/*"
-                      ],
-                      "metadata": {
-                        "description": "Optional. An array of data actions that are allowed."
-                      }
-                    },
-                    "principalIds": {
-                      "type": "array",
-                      "defaultValue": [],
-                      "metadata": {
-                        "description": "Optional. Ids needs to be granted."
-                      }
-                    },
-                    "roleName": {
-                      "type": "string",
-                      "defaultValue": "Reader Writer",
-                      "metadata": {
-                        "description": "Optional. A user-friendly name for the Role Definition. Must be unique for the database account."
-                      }
-                    },
-                    "roleType": {
-                      "type": "string",
-                      "defaultValue": "CustomRole",
-                      "allowedValues": [
-                        "CustomRole",
-                        "BuiltInRole"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Indicates whether the Role Definition was built-in or user created."
-                      }
-                    }
-                  },
-                  "resources": [
-                    {
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('sql-role-definition-{0}', uniqueString(parameters('name')))]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "databaseAccountName": {
-                            "value": "[parameters('databaseAccountName')]"
-                          },
-                          "dataActions": {
-                            "value": "[parameters('dataActions')]"
-                          },
-                          "roleName": {
-                            "value": "[parameters('roleName')]"
-                          },
-                          "roleType": {
-                            "value": "[parameters('roleType')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.34.44.8038",
-                              "templateHash": "16003674161646405716"
-                            },
-                            "name": "DocumentDB Database Account SQL Role Definitions.",
-                            "description": "This module deploys a SQL Role Definision in a CosmosDB Account."
-                          },
-                          "parameters": {
-                            "databaseAccountName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "dataActions": {
-                              "type": "array",
-                              "defaultValue": [],
-                              "metadata": {
-                                "description": "Optional. An array of data actions that are allowed."
-                              }
-                            },
-                            "roleName": {
-                              "type": "string",
-                              "defaultValue": "Reader Writer",
-                              "metadata": {
-                                "description": "Optional. A user-friendly name for the Role Definition. Must be unique for the database account."
-                              }
-                            },
-                            "roleType": {
-                              "type": "string",
-                              "defaultValue": "CustomRole",
-                              "allowedValues": [
-                                "CustomRole",
-                                "BuiltInRole"
-                              ],
-                              "metadata": {
-                                "description": "Optional. Indicates whether the Role Definition was built-in or user created."
-                              }
-                            }
-                          },
-                          "resources": [
-                            {
-                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions",
-                              "apiVersion": "2024-11-15",
-                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role'))]",
-                              "properties": {
-                                "assignableScopes": [
-                                  "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
-                                ],
-                                "permissions": [
-                                  {
-                                    "dataActions": "[parameters('dataActions')]"
-                                  }
-                                ],
-                                "roleName": "[parameters('roleName')]",
-                                "type": "[parameters('roleType')]"
-                              }
-                            }
-                          ],
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the SQL database."
-                              },
-                              "value": "[guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the SQL database."
-                              },
-                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('databaseAccountName'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the resource group the SQL database was created in."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    {
-                      "copy": {
-                        "name": "sqlRoleAssignment",
-                        "count": "[length(parameters('principalIds'))]",
-                        "mode": "serial",
-                        "batchSize": 1
-                      },
-                      "condition": "[not(empty(parameters('principalIds')[copyIndex()]))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('sql-role-assign-{0}', uniqueString(parameters('principalIds')[copyIndex()]))]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[guid(reference(resourceId('Microsoft.Resources/deployments', format('sql-role-definition-{0}', uniqueString(parameters('name')))), '2022-09-01').outputs.resourceId.value, parameters('principalIds')[copyIndex()], resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))]"
-                          },
-                          "databaseAccountName": {
-                            "value": "[parameters('databaseAccountName')]"
-                          },
-                          "roleDefinitionId": {
-                            "value": "[reference(resourceId('Microsoft.Resources/deployments', format('sql-role-definition-{0}', uniqueString(parameters('name')))), '2022-09-01').outputs.resourceId.value]"
-                          },
-                          "principalId": {
-                            "value": "[parameters('principalIds')[copyIndex()]]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.34.44.8038",
-                              "templateHash": "16164048892239373889"
-                            },
-                            "name": "DocumentDB Database Account SQL Role Assignments.",
-                            "description": "This module deploys a SQL Role Assignment in a CosmosDB Account."
-                          },
-                          "parameters": {
-                            "databaseAccountName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the SQL Role Assignment."
-                              }
-                            },
-                            "principalId": {
-                              "type": "string",
-                              "defaultValue": "",
-                              "metadata": {
-                                "description": "Optional. Id needs to be granted."
-                              }
-                            },
-                            "roleDefinitionId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Id of the SQL Role Definition."
-                              }
-                            }
-                          },
-                          "resources": [
-                            {
-                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
-                              "apiVersion": "2024-11-15",
-                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
-                              "properties": {
-                                "principalId": "[parameters('principalId')]",
-                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
-                                "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
-                              }
-                            }
-                          ],
-                          "outputs": {
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the resource group the SQL Role Assignment was created in."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "[resourceId('Microsoft.Resources/deployments', format('sql-role-definition-{0}', uniqueString(parameters('name'))))]"
-                      ]
-                    }
-                  ],
-                  "outputs": {
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the resource group the SQL Role Definition and Assignment were created in."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "databaseAccount"
-              ]
-            },
-            "databaseAccount_mongodbDatabases": {
-              "copy": {
-                "name": "databaseAccount_mongodbDatabases",
-                "count": "[length(parameters('mongodbDatabases'))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-mongodb-{1}', uniqueString(deployment().name, parameters('location')), parameters('mongodbDatabases')[copyIndex()].name)]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "databaseAccountName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[parameters('mongodbDatabases')[copyIndex()].name]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(parameters('mongodbDatabases')[copyIndex()], 'tags'), parameters('tags'))]"
-                  },
-                  "collections": {
-                    "value": "[tryGet(parameters('mongodbDatabases')[copyIndex()], 'collections')]"
-                  },
-                  "throughput": {
-                    "value": "[tryGet(parameters('mongodbDatabases')[copyIndex()], 'throughput')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "918699205331356852"
-                    },
-                    "name": "DocumentDB Database Account MongoDB Databases",
-                    "description": "This module deploys a MongoDB Database within a CosmosDB Account."
-                  },
-                  "parameters": {
-                    "databaseAccountName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the mongodb database."
-                      }
-                    },
-                    "throughput": {
-                      "type": "int",
-                      "defaultValue": 400,
-                      "metadata": {
-                        "description": "Optional. Request Units per second. Setting throughput at the database level is only recommended for development/test or when workload across all collections in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level."
-                      }
-                    },
-                    "collections": {
-                      "type": "array",
-                      "defaultValue": [],
-                      "metadata": {
-                        "description": "Optional. Collections in the mongodb database."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the resource."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "databaseAccount": {
-                      "existing": true,
-                      "type": "Microsoft.DocumentDB/databaseAccounts",
-                      "apiVersion": "2024-11-15",
-                      "name": "[parameters('databaseAccountName')]"
-                    },
-                    "mongodbDatabase": {
-                      "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases",
-                      "apiVersion": "2024-11-15",
-                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "resource": {
-                          "id": "[parameters('name')]"
-                        },
-                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]"
-                      },
-                      "dependsOn": [
-                        "databaseAccount"
-                      ]
-                    },
-                    "mongodbDatabase_collections": {
-                      "copy": {
-                        "name": "mongodbDatabase_collections",
-                        "count": "[length(parameters('collections'))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-collection-{1}', uniqueString(deployment().name, parameters('name')), parameters('collections')[copyIndex()].name)]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "databaseAccountName": {
-                            "value": "[parameters('databaseAccountName')]"
-                          },
-                          "mongodbDatabaseName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "name": {
-                            "value": "[parameters('collections')[copyIndex()].name]"
-                          },
-                          "indexes": {
-                            "value": "[parameters('collections')[copyIndex()].indexes]"
-                          },
-                          "shardKey": {
-                            "value": "[parameters('collections')[copyIndex()].shardKey]"
-                          },
-                          "throughput": {
-                            "value": "[tryGet(parameters('collections')[copyIndex()], 'throughput')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.34.44.8038",
-                              "templateHash": "5747070610235343863"
-                            },
-                            "name": "DocumentDB Database Account MongoDB Database Collections",
-                            "description": "This module deploys a MongoDB Database Collection."
-                          },
-                          "parameters": {
-                            "databaseAccountName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "mongodbDatabaseName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent mongodb database. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the collection."
-                              }
-                            },
-                            "throughput": {
-                              "type": "int",
-                              "defaultValue": 400,
-                              "metadata": {
-                                "description": "Optional. Request Units per second. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level."
-                              }
-                            },
-                            "indexes": {
-                              "type": "array",
-                              "metadata": {
-                                "description": "Required. Indexes for the collection."
-                              }
-                            },
-                            "shardKey": {
-                              "type": "object",
-                              "metadata": {
-                                "description": "Required. ShardKey for the collection."
-                              }
-                            }
-                          },
-                          "resources": [
-                            {
-                              "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections",
-                              "apiVersion": "2024-11-15",
-                              "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]",
-                              "properties": {
-                                "options": "[if(contains(reference(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), '2024-11-15').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]",
-                                "resource": {
-                                  "id": "[parameters('name')]",
-                                  "indexes": "[parameters('indexes')]",
-                                  "shardKey": "[parameters('shardKey')]"
-                                }
-                              }
-                            }
-                          ],
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the mongodb database collection."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the mongodb database collection."
-                              },
-                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the resource group the mongodb database collection was created in."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "mongodbDatabase"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the mongodb database."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the mongodb database."
-                      },
-                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases', parameters('databaseAccountName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the resource group the mongodb database was created in."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "databaseAccount"
-              ]
-            },
-            "databaseAccount_gremlinDatabases": {
-              "copy": {
-                "name": "databaseAccount_gremlinDatabases",
-                "count": "[length(parameters('gremlinDatabases'))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-gremlin-{1}', uniqueString(deployment().name, parameters('location')), parameters('gremlinDatabases')[copyIndex()].name)]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "databaseAccountName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[parameters('gremlinDatabases')[copyIndex()].name]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(parameters('gremlinDatabases')[copyIndex()], 'tags'), parameters('tags'))]"
-                  },
-                  "graphs": {
-                    "value": "[tryGet(parameters('gremlinDatabases')[copyIndex()], 'graphs')]"
-                  },
-                  "maxThroughput": {
-                    "value": "[tryGet(parameters('gremlinDatabases')[copyIndex()], 'maxThroughput')]"
-                  },
-                  "throughput": {
-                    "value": "[tryGet(parameters('gremlinDatabases')[copyIndex()], 'throughput')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "3102415923148662010"
-                    },
-                    "name": "DocumentDB Database Account Gremlin Databases",
-                    "description": "This module deploys a Gremlin Database within a CosmosDB Account."
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the Gremlin database."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the Gremlin database resource."
-                      }
-                    },
-                    "databaseAccountName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Gremlin database. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "graphs": {
-                      "type": "array",
-                      "defaultValue": [],
-                      "metadata": {
-                        "description": "Optional. Array of graphs to deploy in the Gremlin database."
-                      }
-                    },
-                    "maxThroughput": {
-                      "type": "int",
-                      "defaultValue": 4000,
-                      "metadata": {
-                        "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level."
-                      }
-                    },
-                    "throughput": {
-                      "type": "int",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "databaseAccount": {
-                      "existing": true,
-                      "type": "Microsoft.DocumentDB/databaseAccounts",
-                      "apiVersion": "2024-11-15",
-                      "name": "[parameters('databaseAccountName')]"
-                    },
-                    "gremlinDatabase": {
-                      "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases",
-                      "apiVersion": "2024-11-15",
-                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]",
-                        "resource": {
-                          "id": "[parameters('name')]"
-                        }
-                      },
-                      "dependsOn": [
-                        "databaseAccount"
-                      ]
-                    },
-                    "gremlinDatabase_gremlinGraphs": {
-                      "copy": {
-                        "name": "gremlinDatabase_gremlinGraphs",
-                        "count": "[length(parameters('graphs'))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-gremlindb-{1}', uniqueString(deployment().name, parameters('name')), parameters('graphs')[copyIndex()].name)]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[parameters('graphs')[copyIndex()].name]"
-                          },
-                          "gremlinDatabaseName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "databaseAccountName": {
-                            "value": "[parameters('databaseAccountName')]"
-                          },
-                          "indexingPolicy": {
-                            "value": "[tryGet(parameters('graphs')[copyIndex()], 'indexingPolicy')]"
-                          },
-                          "partitionKeyPaths": "[if(not(empty(parameters('graphs')[copyIndex()].partitionKeyPaths)), createObject('value', parameters('graphs')[copyIndex()].partitionKeyPaths), createObject('value', createArray()))]"
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.34.44.8038",
-                              "templateHash": "14448207336426896249"
-                            },
-                            "name": "DocumentDB Database Accounts Gremlin Databases Graphs",
-                            "description": "This module deploys a DocumentDB Database Accounts Gremlin Database Graph."
-                          },
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the graph."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Tags of the Gremlin graph resource."
-                              }
-                            },
-                            "databaseAccountName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "gremlinDatabaseName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Gremlin Database. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "indexingPolicy": {
-                              "type": "object",
-                              "defaultValue": {},
-                              "metadata": {
-                                "description": "Optional. Indexing policy of the graph."
-                              }
-                            },
-                            "partitionKeyPaths": {
-                              "type": "array",
-                              "defaultValue": [],
-                              "metadata": {
-                                "description": "Optional. List of paths using which data within the container can be partitioned."
-                              }
-                            }
-                          },
-                          "resources": {
-                            "databaseAccount::gremlinDatabase": {
-                              "existing": true,
-                              "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases",
-                              "apiVersion": "2024-11-15",
-                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'))]"
-                            },
-                            "databaseAccount": {
-                              "existing": true,
-                              "type": "Microsoft.DocumentDB/databaseAccounts",
-                              "apiVersion": "2024-11-15",
-                              "name": "[parameters('databaseAccountName')]"
-                            },
-                            "gremlinGraph": {
-                              "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs",
-                              "apiVersion": "2024-11-15",
-                              "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]",
-                              "tags": "[parameters('tags')]",
-                              "properties": {
-                                "resource": {
-                                  "id": "[parameters('name')]",
-                                  "indexingPolicy": "[if(not(empty(parameters('indexingPolicy'))), parameters('indexingPolicy'), null())]",
-                                  "partitionKey": {
-                                    "paths": "[if(not(empty(parameters('partitionKeyPaths'))), parameters('partitionKeyPaths'), null())]"
-                                  }
-                                }
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the graph."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the graph."
-                              },
-                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the resource group the graph was created in."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "gremlinDatabase"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the Gremlin database."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the Gremlin database."
-                      },
-                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases', parameters('databaseAccountName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the resource group the Gremlin database was created in."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "databaseAccount"
-              ]
-            },
-            "databaseAccount_tables": {
-              "copy": {
-                "name": "databaseAccount_tables",
-                "count": "[length(parameters('tables'))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-table-{1}', uniqueString(deployment().name, parameters('location')), parameters('tables')[copyIndex()].name)]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "databaseAccountName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[parameters('tables')[copyIndex()].name]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(parameters('tables')[copyIndex()], 'tags'), parameters('tags'))]"
-                  },
-                  "maxThroughput": {
-                    "value": "[tryGet(parameters('tables')[copyIndex()], 'maxThroughput')]"
-                  },
-                  "throughput": {
-                    "value": "[tryGet(parameters('tables')[copyIndex()], 'throughput')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "6386293577244138652"
-                    },
-                    "name": "Azure Cosmos DB account tables",
-                    "description": "This module deploys a table within an Azure Cosmos DB Account."
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the table."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags for the table."
-                      }
-                    },
-                    "databaseAccountName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Azure Cosmos DB account. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "maxThroughput": {
-                      "type": "int",
-                      "defaultValue": 4000,
-                      "metadata": {
-                        "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored."
-                      }
-                    },
-                    "throughput": {
-                      "type": "int",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "databaseAccount": {
-                      "existing": true,
-                      "type": "Microsoft.DocumentDB/databaseAccounts",
-                      "apiVersion": "2024-11-15",
-                      "name": "[parameters('databaseAccountName')]"
-                    },
-                    "table": {
-                      "type": "Microsoft.DocumentDB/databaseAccounts/tables",
-                      "apiVersion": "2024-11-15",
-                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]",
-                        "resource": {
-                          "id": "[parameters('name')]"
-                        }
-                      },
-                      "dependsOn": [
-                        "databaseAccount"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the table."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the table."
-                      },
-                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/tables', parameters('databaseAccountName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the resource group the table was created in."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "databaseAccount"
-              ]
-            },
-            "databaseAccount_privateEndpoints": {
-              "copy": {
-                "name": "databaseAccount_privateEndpoints",
-                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-databaseAccount-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
-              "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]"
-                  },
-                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]",
-                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
-                  "subnetResourceId": {
-                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
-                  },
-                  "enableTelemetry": {
-                    "value": "[variables('enableReferencedModulesTelemetry')]"
-                  },
-                  "location": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
-                  },
-                  "lock": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
-                  },
-                  "privateDnsZoneGroup": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                  },
-                  "customDnsConfigs": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
-                  },
-                  "ipConfigurations": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
-                  },
-                  "applicationSecurityGroupResourceIds": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
-                  },
-                  "customNetworkInterfaceName": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.33.13.18514",
-                      "templateHash": "15954548978129725136"
-                    },
-                    "name": "Private Endpoints",
-                    "description": "This module deploys a Private Endpoint."
-                  },
-                  "definitions": {
-                    "privateDnsZoneGroupType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the Private DNS Zone Group."
-                          }
-                        },
-                        "privateDnsZoneGroupConfigs": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                          },
-                          "metadata": {
-                            "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true
-                      }
-                    },
-                    "ipConfigurationType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the resource that is unique within a resource group."
-                          }
-                        },
-                        "properties": {
-                          "type": "object",
-                          "properties": {
-                            "groupId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                              }
-                            },
-                            "memberName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                              }
-                            },
-                            "privateIPAddress": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. Properties of private endpoint IP configurations."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true
-                      }
-                    },
-                    "privateLinkServiceConnectionType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the private link service connection."
-                          }
-                        },
-                        "properties": {
-                          "type": "object",
-                          "properties": {
-                            "groupIds": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "metadata": {
-                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
-                              }
-                            },
-                            "privateLinkServiceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The resource id of private link service."
-                              }
-                            },
-                            "requestMessage": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. Properties of private link service connection."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true
-                      }
-                    },
-                    "customDnsConfigType": {
-                      "type": "object",
-                      "properties": {
-                        "fqdn": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. FQDN that resolves to private endpoint IP address."
-                          }
-                        },
-                        "ipAddresses": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "Required. A list of private IP addresses of the private endpoint."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true
-                      }
-                    },
-                    "lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "privateDnsZoneGroupConfigType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the private DNS zone group config."
-                          }
-                        },
-                        "privateDnsZoneResourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The resource id of the private DNS zone."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "private-dns-zone-group/main.bicep"
-                        }
-                      }
-                    },
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the private endpoint resource to create."
-                      }
-                    },
-                    "subnetResourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                      }
-                    },
-                    "applicationSecurityGroupResourceIds": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
-                      }
-                    },
-                    "customNetworkInterfaceName": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                      }
-                    },
-                    "ipConfigurations": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/ipConfigurationType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
-                      }
-                    },
-                    "privateDnsZoneGroup": {
-                      "$ref": "#/definitions/privateDnsZoneGroupType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The private DNS zone group to configure for the private endpoint."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all Resources."
-                      }
-                    },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The lock settings of the service."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
-                      }
-                    },
-                    "customDnsConfigs": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/customDnsConfigType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Custom DNS configurations."
-                      }
-                    },
-                    "manualPrivateLinkServiceConnections": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/privateLinkServiceConnectionType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
-                      }
-                    },
-                    "privateLinkServiceConnections": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/privateLinkServiceConnectionType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
-                      }
-                    },
-                    "enableTelemetry": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Enable/Disable usage telemetry for module."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
-                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
-                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
-                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
-                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
-                    }
-                  },
-                  "resources": {
-                    "avmTelemetry": {
-                      "condition": "[parameters('enableTelemetry')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2024-03-01",
-                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.10.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                      "properties": {
-                        "mode": "Incremental",
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "resources": [],
-                          "outputs": {
-                            "telemetry": {
-                              "type": "String",
-                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "privateEndpoint": {
-                      "type": "Microsoft.Network/privateEndpoints",
-                      "apiVersion": "2023-11-01",
-                      "name": "[parameters('name')]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "copy": [
-                          {
-                            "name": "applicationSecurityGroups",
-                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
-                            "input": {
-                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
-                            }
-                          }
-                        ],
-                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
-                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
-                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
-                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
-                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
-                        "subnet": {
-                          "id": "[parameters('subnetResourceId')]"
-                        }
-                      }
-                    },
-                    "privateEndpoint_lock": {
-                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                      "type": "Microsoft.Authorization/locks",
-                      "apiVersion": "2020-05-01",
-                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                      "properties": {
-                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-                      },
-                      "dependsOn": [
-                        "privateEndpoint"
-                      ]
-                    },
-                    "privateEndpoint_roleAssignments": {
-                      "copy": {
-                        "name": "privateEndpoint_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "privateEndpoint"
-                      ]
-                    },
-                    "privateEndpoint_privateDnsZoneGroup": {
-                      "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
-                          },
-                          "privateEndpointName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "privateDnsZoneConfigs": {
-                            "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.33.13.18514",
-                              "templateHash": "5440815542537978381"
-                            },
-                            "name": "Private Endpoint Private DNS Zone Groups",
-                            "description": "This module deploys a Private Endpoint Private DNS Zone Group."
-                          },
-                          "definitions": {
-                            "privateDnsZoneGroupConfigType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of the private DNS zone group config."
-                                  }
-                                },
-                                "privateDnsZoneResourceId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The resource id of the private DNS zone."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "privateEndpointName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "privateDnsZoneConfigs": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                              },
-                              "minLength": 1,
-                              "maxLength": 5,
-                              "metadata": {
-                                "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "defaultValue": "default",
-                              "metadata": {
-                                "description": "Optional. The name of the private DNS zone group."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "copy": [
-                              {
-                                "name": "privateDnsZoneConfigsVar",
-                                "count": "[length(parameters('privateDnsZoneConfigs'))]",
-                                "input": {
-                                  "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
-                                  "properties": {
-                                    "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
-                                  }
-                                }
-                              }
-                            ]
-                          },
-                          "resources": {
-                            "privateEndpoint": {
-                              "existing": true,
-                              "type": "Microsoft.Network/privateEndpoints",
-                              "apiVersion": "2023-11-01",
-                              "name": "[parameters('privateEndpointName')]"
-                            },
-                            "privateDnsZoneGroup": {
-                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
-                              "apiVersion": "2023-11-01",
-                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
-                              "properties": {
-                                "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the private endpoint DNS zone group."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the private endpoint DNS zone group."
-                              },
-                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group the private endpoint DNS zone group was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "privateEndpoint"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group the private endpoint was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the private endpoint."
-                      },
-                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the private endpoint."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('privateEndpoint', '2023-11-01', 'full').location]"
-                    },
-                    "customDnsConfigs": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/customDnsConfigType"
-                      },
-                      "metadata": {
-                        "description": "The custom DNS configurations of the private endpoint."
-                      },
-                      "value": "[reference('privateEndpoint').customDnsConfigs]"
-                    },
-                    "networkInterfaceResourceIds": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "metadata": {
-                        "description": "The resource IDs of the network interfaces associated with the private endpoint."
-                      },
-                      "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
-                    },
-                    "groupId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "The group Id for the private endpoint Group."
-                      },
-                      "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "databaseAccount"
-              ]
-            },
-            "secretsExport": {
-              "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]",
-              "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]",
-              "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "keyVaultName": {
-                    "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]"
-                  },
-                  "secretsToSet": {
-                    "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'primaryWriteKeySecretName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'primaryWriteKeySecretName'), 'value', listKeys(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2024-11-15').primaryMasterKey)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'primaryReadOnlyKeySecretName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'primaryReadOnlyKeySecretName'), 'value', listKeys(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2024-11-15').primaryReadonlyMasterKey)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'primaryWriteConnectionStringSecretName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'primaryWriteConnectionStringSecretName'), 'value', listConnectionStrings(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2024-11-15').connectionStrings[0].connectionString)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'primaryReadonlyConnectionStringSecretName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'primaryReadonlyConnectionStringSecretName'), 'value', listConnectionStrings(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2024-11-15').connectionStrings[2].connectionString)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'secondaryWriteKeySecretName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'secondaryWriteKeySecretName'), 'value', listKeys(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2024-11-15').secondaryMasterKey)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'secondaryReadonlyKeySecretName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'secondaryReadonlyKeySecretName'), 'value', listKeys(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2024-11-15').secondaryReadonlyMasterKey)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'secondaryWriteConnectionStringSecretName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'secondaryWriteConnectionStringSecretName'), 'value', listConnectionStrings(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2024-11-15').connectionStrings[1].connectionString)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'secondaryReadonlyConnectionStringSecretName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'secondaryReadonlyConnectionStringSecretName'), 'value', listConnectionStrings(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2024-11-15').connectionStrings[3].connectionString)), createArray()))]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "17295277467511711636"
-                    }
-                  },
-                  "definitions": {
-                    "secretSetType": {
-                      "type": "object",
-                      "properties": {
-                        "secretResourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "The resourceId of the exported secret."
-                          }
-                        },
-                        "secretUri": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "The secret URI of the exported secret."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for the secret set."
-                      }
-                    },
-                    "secretToSetType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the secret to set."
-                          }
-                        },
-                        "value": {
-                          "type": "securestring",
-                          "metadata": {
-                            "description": "Required. The value of the secret to set."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for the secrets to set."
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "keyVaultName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the Key Vault to set the ecrets in."
-                      }
-                    },
-                    "secretsToSet": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/secretToSetType"
-                      },
-                      "metadata": {
-                        "description": "Required. The secrets to set in the Key Vault."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "keyVault": {
-                      "existing": true,
-                      "type": "Microsoft.KeyVault/vaults",
-                      "apiVersion": "2023-07-01",
-                      "name": "[parameters('keyVaultName')]"
-                    },
-                    "secrets": {
-                      "copy": {
-                        "name": "secrets",
-                        "count": "[length(parameters('secretsToSet'))]"
-                      },
-                      "type": "Microsoft.KeyVault/vaults/secrets",
-                      "apiVersion": "2023-07-01",
-                      "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]",
-                      "properties": {
-                        "value": "[parameters('secretsToSet')[copyIndex()].value]"
-                      }
-                    }
-                  },
-                  "outputs": {
-                    "secretsSet": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/secretSetType"
-                      },
-                      "metadata": {
-                        "description": "The references to the secrets exported to the provided Key Vault."
-                      },
-                      "copy": {
-                        "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]",
-                        "input": {
-                          "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]",
-                          "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]"
-                        }
-                      }
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "databaseAccount"
-              ]
-            }
-          },
-          "outputs": {
-            "exportedSecrets": {
-              "$ref": "#/definitions/secretsOutputType",
-              "metadata": {
-                "description": "The references to the secrets exported to the provided Key Vault."
-              },
-              "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]"
-            },
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the database account."
-              },
-              "value": "[parameters('name')]"
-            },
-            "resourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource ID of the database account."
-              },
-              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]"
-            },
-            "resourceGroupName": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the resource group the database account was created in."
-              },
-              "value": "[resourceGroup().name]"
-            },
-            "systemAssignedMIPrincipalId": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "The principal ID of the system assigned identity."
-              },
-              "value": "[tryGet(tryGet(reference('databaseAccount', '2024-11-15', 'full'), 'identity'), 'principalId')]"
-            },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "The location the resource was deployed into."
-              },
-              "value": "[reference('databaseAccount', '2024-11-15', 'full').location]"
-            },
-            "endpoint": {
-              "type": "string",
-              "metadata": {
-                "description": "The endpoint of the database account."
-              },
-              "value": "[reference('databaseAccount').documentEndpoint]"
-            },
-            "privateEndpoints": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/privateEndpointOutputType"
-              },
-              "metadata": {
-                "description": "The private endpoints of the database account."
-              },
-              "copy": {
-                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
-                "input": {
-                  "name": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
-                  "resourceId": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
-                  "groupId": "[tryGet(tryGet(reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
-                  "customDnsConfigs": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
-                  "networkInterfaceResourceIds": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
-                }
-              }
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "containerApp",
-        "logAnalyticsWorkspace",
-        "privateDnsZonesCosmosDb",
-        "virtualNetwork"
-      ]
-    },
-    "containerAppEnvironment": {
-      "condition": "[variables('containerAppEnvironmentEnabled')]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2022-09-01",
-      "name": "[take(format('module.container-app-environment.{0}', variables('containerAppEnvironmentResourceName')), 64)]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[variables('containerAppEnvironmentResourceName')]"
-          },
-          "tags": {
-            "value": "[coalesce(tryGet(parameters('containerAppEnvironmentConfiguration'), 'tags'), parameters('tags'))]"
-          },
-          "location": {
-            "value": "[coalesce(tryGet(parameters('containerAppEnvironmentConfiguration'), 'location'), parameters('solutionLocation'))]"
-          },
-          "logAnalyticsResourceId": "[if(variables('useExistingWorkspace'), createObject('value', variables('existingWorkspaceResourceId')), createObject('value', listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId))]",
-          "publicNetworkAccess": {
-            "value": "Enabled"
-          },
-          "zoneRedundant": {
-            "value": false
-          },
-          "applicationInsightsConnectionString": {
-            "value": "[reference('applicationInsights').outputs.connectionString.value]"
-          },
-          "enableTelemetry": {
-            "value": "[parameters('enableTelemetry')]"
-          },
-          "subnetResourceId": "[if(variables('virtualNetworkEnabled'), createObject('value', coalesce(coalesce(tryGet(parameters('containerAppEnvironmentConfiguration'), 'subnetResourceId'), tryGet(tryGet(tryGet(reference('virtualNetwork'), 'outputs'), 'subnetResourceIds'), 'value', 3)), '')), createObject('value', ''))]"
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.36.1.42791",
-              "templateHash": "4058239350318625283"
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string"
-            },
-            "location": {
-              "type": "string"
-            },
-            "logAnalyticsResourceId": {
-              "type": "string"
-            },
-            "tags": {
-              "type": "object"
-            },
-            "publicNetworkAccess": {
-              "type": "string"
-            },
-            "zoneRedundant": {
-              "type": "bool"
-            },
-            "enableTelemetry": {
-              "type": "bool"
-            },
-            "subnetResourceId": {
-              "type": "string"
-            },
-            "applicationInsightsConnectionString": {
-              "type": "string"
-            }
-          },
-          "variables": {
-            "logAnalyticsSubscription": "[split(parameters('logAnalyticsResourceId'), '/')[2]]",
-            "logAnalyticsResourceGroup": "[split(parameters('logAnalyticsResourceId'), '/')[4]]",
-            "logAnalyticsName": "[split(parameters('logAnalyticsResourceId'), '/')[8]]"
-          },
-          "resources": [
-            {
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[take(format('avm.res.app.managed-environment.{0}', parameters('name')), 64)]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[parameters('name')]"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "tags": {
-                    "value": "[parameters('tags')]"
-                  },
-                  "enableTelemetry": {
-                    "value": "[parameters('enableTelemetry')]"
-                  },
-                  "appLogsConfiguration": {
-                    "value": {
-                      "destination": "log-analytics",
-                      "logAnalyticsConfiguration": {
-                        "customerId": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('logAnalyticsSubscription'), variables('logAnalyticsResourceGroup')), 'Microsoft.OperationalInsights/workspaces', variables('logAnalyticsName')), '2020-08-01').customerId]",
-                        "sharedKey": "[listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('logAnalyticsSubscription'), variables('logAnalyticsResourceGroup')), 'Microsoft.OperationalInsights/workspaces', variables('logAnalyticsName')), '2020-08-01').primarySharedKey]"
-                      }
-                    }
-                  },
-                  "workloadProfiles": {
-                    "value": [
-                      {
-                        "name": "Consumption",
-                        "workloadProfileType": "Consumption"
-                      }
-                    ]
-                  },
-                  "publicNetworkAccess": {
-                    "value": "[parameters('publicNetworkAccess')]"
-                  },
-                  "appInsightsConnectionString": {
-                    "value": "[parameters('applicationInsightsConnectionString')]"
-                  },
-                  "zoneRedundant": {
-                    "value": "[parameters('zoneRedundant')]"
-                  },
-                  "infrastructureSubnetResourceId": {
-                    "value": "[parameters('subnetResourceId')]"
-                  },
-                  "internal": {
-                    "value": false
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.35.1.17967",
-                      "templateHash": "7921731604646231285"
-                    },
-                    "name": "App ManagedEnvironments",
-                    "description": "This module deploys an App Managed Environment (also known as a Container App Environment)."
-                  },
-                  "definitions": {
-                    "certificateType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the certificate."
-                          }
-                        },
-                        "certificateType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "ImagePullTrustedCA",
-                            "ServerSSLCertificate"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The type of the certificate."
-                          }
-                        },
-                        "certificateValue": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The value of the certificate. PFX or PEM blob."
-                          }
-                        },
-                        "certificatePassword": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The password of the certificate."
-                          }
-                        },
-                        "certificateKeyVaultProperties": {
-                          "$ref": "#/definitions/certificateKeyVaultPropertiesType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A key vault reference."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for a certificate."
-                      }
-                    },
-                    "storageType": {
-                      "type": "object",
-                      "properties": {
-                        "accessMode": {
-                          "type": "string",
-                          "allowedValues": [
-                            "ReadOnly",
-                            "ReadWrite"
-                          ],
-                          "metadata": {
-                            "description": "Required. Access mode for storage: \"ReadOnly\" or \"ReadWrite\"."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "NFS",
-                            "SMB"
-                          ],
-                          "metadata": {
-                            "description": "Required. Type of storage: \"SMB\" or \"NFS\"."
-                          }
-                        },
-                        "storageAccountName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Storage account name."
-                          }
-                        },
-                        "shareName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. File share name."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type of the storage."
-                      }
-                    },
-                    "appLogsConfigurationType": {
-                      "type": "object",
-                      "properties": {
-                        "destination": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The destination of the logs."
-                          }
-                        },
-                        "logAnalyticsConfiguration": {
-                          "type": "object",
-                          "properties": {
-                            "customerId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The Log Analytics Workspace ID."
-                              }
-                            },
-                            "sharedKey": {
-                              "type": "securestring",
-                              "metadata": {
-                                "description": "Required. The shared key of the Log Analytics workspace."
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The configuration for Log Analytics."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for the App Logs Configuration."
-                      }
-                    },
-                    "certificateKeyVaultPropertiesType": {
-                      "type": "object",
-                      "properties": {
-                        "identityResourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The resource ID of the identity. This is the identity that will be used to access the key vault."
-                          }
-                        },
-                        "keyVaultUrl": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. A key vault URL referencing the wildcard certificate that will be used for the custom domain."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for the certificate's key vault properties.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "certificates/main.bicep"
-                        }
-                      }
-                    },
-                    "lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "managedIdentityAllType": {
-                      "type": "object",
-                      "properties": {
-                        "systemAssigned": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enables system assigned managed identity on the resource."
-                          }
-                        },
-                        "userAssignedResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the Container Apps Managed Environment."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all Resources."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the resource."
-                      }
-                    },
-                    "managedIdentities": {
-                      "$ref": "#/definitions/managedIdentityAllType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The managed identity definition for this resource."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    },
-                    "enableTelemetry": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Enable/Disable usage telemetry for module."
-                      }
-                    },
-                    "appInsightsConnectionString": {
-                      "type": "securestring",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. Application Insights connection string."
-                      }
-                    },
-                    "daprAIConnectionString": {
-                      "type": "securestring",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. Application Insights connection string used by Dapr to export Service to Service communication telemetry."
-                      }
-                    },
-                    "daprAIInstrumentationKey": {
-                      "type": "securestring",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. Azure Monitor instrumentation key used by Dapr to export Service to Service communication telemetry."
-                      }
-                    },
-                    "dockerBridgeCidr": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Conditional. CIDR notation IP range assigned to the Docker bridge, network. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant."
-                      }
-                    },
-                    "infrastructureSubnetResourceId": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Conditional. Resource ID of a subnet for infrastructure components. This is used to deploy the environment into a virtual network. Must not overlap with any other provided IP ranges. Required if \"internal\" is set to true. Required if zoneRedundant is set to true to make the resource WAF compliant."
-                      }
-                    },
-                    "internal": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Conditional. Boolean indicating the environment only has an internal load balancer. These environments do not have a public static IP resource. If set to true, then \"infrastructureSubnetId\" must be provided. Required if zoneRedundant is set to true to make the resource WAF compliant."
-                      }
-                    },
-                    "platformReservedCidr": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Conditional. IP range in CIDR notation that can be reserved for environment infrastructure IP addresses. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true  to make the resource WAF compliant."
-                      }
-                    },
-                    "platformReservedDnsIP": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Conditional. An IP address from the IP range defined by \"platformReservedCidr\" that will be reserved for the internal DNS server. It must not be the first address in the range and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant."
-                      }
-                    },
-                    "peerTrafficEncryption": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Whether or not to encrypt peer traffic."
-                      }
-                    },
-                    "publicNetworkAccess": {
-                      "type": "string",
-                      "defaultValue": "Disabled",
-                      "allowedValues": [
-                        "Enabled",
-                        "Disabled"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Whether to allow or block all public traffic."
-                      }
-                    },
-                    "zoneRedundant": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Whether or not this Managed Environment is zone-redundant."
-                      }
-                    },
-                    "certificatePassword": {
-                      "type": "securestring",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. Password of the certificate used by the custom domain."
-                      }
-                    },
-                    "certificateValue": {
-                      "type": "securestring",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. Certificate to use for the custom domain. PFX or PEM."
-                      }
-                    },
-                    "dnsSuffix": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. DNS suffix for the environment domain."
-                      }
-                    },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The lock settings of the service."
-                      }
-                    },
-                    "openTelemetryConfiguration": {
-                      "type": "object",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Open Telemetry configuration."
-                      }
-                    },
-                    "workloadProfiles": {
-                      "type": "array",
-                      "defaultValue": [],
-                      "metadata": {
-                        "description": "Conditional. Workload profiles configured for the Managed Environment. Required if zoneRedundant is set to true to make the resource WAF compliant."
-                      }
-                    },
-                    "infrastructureResourceGroupName": {
-                      "type": "string",
-                      "defaultValue": "[take(format('ME_{0}', parameters('name')), 63)]",
-                      "metadata": {
-                        "description": "Conditional. Name of the infrastructure resource group. If not provided, it will be set with a default value. Required if zoneRedundant is set to true to make the resource WAF compliant."
-                      }
-                    },
-                    "storages": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/storageType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The list of storages to mount on the environment."
-                      }
-                    },
-                    "certificate": {
-                      "$ref": "#/definitions/certificateType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. A Managed Environment Certificate."
-                      }
-                    },
-                    "appLogsConfiguration": {
-                      "$ref": "#/definitions/appLogsConfigurationType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The AppLogsConfiguration for the Managed Environment."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "managedEnvironment::storage": {
-                      "copy": {
-                        "name": "managedEnvironment::storage",
-                        "count": "[length(coalesce(parameters('storages'), createArray()))]"
-                      },
-                      "type": "Microsoft.App/managedEnvironments/storages",
-                      "apiVersion": "2024-10-02-preview",
-                      "name": "[format('{0}/{1}', parameters('name'), coalesce(parameters('storages'), createArray())[copyIndex()].shareName)]",
-                      "properties": {
-                        "nfsAzureFile": "[if(equals(coalesce(parameters('storages'), createArray())[copyIndex()].kind, 'NFS'), createObject('accessMode', coalesce(parameters('storages'), createArray())[copyIndex()].accessMode, 'server', format('{0}.file.{1}', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName, environment().suffixes.storage), 'shareName', format('/{0}/{1}', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName, coalesce(parameters('storages'), createArray())[copyIndex()].shareName)), null())]",
-                        "azureFile": "[if(equals(coalesce(parameters('storages'), createArray())[copyIndex()].kind, 'SMB'), createObject('accessMode', coalesce(parameters('storages'), createArray())[copyIndex()].accessMode, 'accountName', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName, 'accountKey', listkeys(resourceId('Microsoft.Storage/storageAccounts', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName), '2023-01-01').keys[0].value, 'shareName', coalesce(parameters('storages'), createArray())[copyIndex()].shareName), null())]"
-                      },
-                      "dependsOn": [
-                        "managedEnvironment"
-                      ]
-                    },
-                    "avmTelemetry": {
-                      "condition": "[parameters('enableTelemetry')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2024-11-01",
-                      "name": "[format('46d3xbcp.res.app-managedenvironment.{0}.{1}', replace('0.11.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                      "properties": {
-                        "mode": "Incremental",
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "resources": [],
-                          "outputs": {
-                            "telemetry": {
-                              "type": "String",
-                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "managedEnvironment": {
-                      "type": "Microsoft.App/managedEnvironments",
-                      "apiVersion": "2024-10-02-preview",
-                      "name": "[parameters('name')]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "identity": "[variables('identity')]",
-                      "properties": {
-                        "appInsightsConfiguration": {
-                          "connectionString": "[parameters('appInsightsConnectionString')]"
-                        },
-                        "appLogsConfiguration": "[parameters('appLogsConfiguration')]",
-                        "daprAIConnectionString": "[parameters('daprAIConnectionString')]",
-                        "daprAIInstrumentationKey": "[parameters('daprAIInstrumentationKey')]",
-                        "customDomainConfiguration": {
-                          "certificatePassword": "[parameters('certificatePassword')]",
-                          "certificateValue": "[if(not(empty(parameters('certificateValue'))), parameters('certificateValue'), null())]",
-                          "dnsSuffix": "[parameters('dnsSuffix')]",
-                          "certificateKeyVaultProperties": "[if(not(empty(tryGet(parameters('certificate'), 'certificateKeyVaultProperties'))), createObject('identity', tryGet(parameters('certificate'), 'certificateKeyVaultProperties', 'identityResourceId'), 'keyVaultUrl', tryGet(parameters('certificate'), 'certificateKeyVaultProperties', 'keyVaultUrl')), null())]"
-                        },
-                        "openTelemetryConfiguration": "[if(not(empty(parameters('openTelemetryConfiguration'))), parameters('openTelemetryConfiguration'), null())]",
-                        "peerTrafficConfiguration": {
-                          "encryption": {
-                            "enabled": "[parameters('peerTrafficEncryption')]"
-                          }
-                        },
-                        "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
-                        "vnetConfiguration": {
-                          "internal": "[parameters('internal')]",
-                          "infrastructureSubnetId": "[if(not(empty(parameters('infrastructureSubnetResourceId'))), parameters('infrastructureSubnetResourceId'), null())]",
-                          "dockerBridgeCidr": "[if(not(empty(parameters('infrastructureSubnetResourceId'))), parameters('dockerBridgeCidr'), null())]",
-                          "platformReservedCidr": "[if(and(empty(parameters('workloadProfiles')), not(empty(parameters('infrastructureSubnetResourceId')))), parameters('platformReservedCidr'), null())]",
-                          "platformReservedDnsIP": "[if(and(empty(parameters('workloadProfiles')), not(empty(parameters('infrastructureSubnetResourceId')))), parameters('platformReservedDnsIP'), null())]"
-                        },
-                        "workloadProfiles": "[if(not(empty(parameters('workloadProfiles'))), parameters('workloadProfiles'), null())]",
-                        "zoneRedundant": "[parameters('zoneRedundant')]",
-                        "infrastructureResourceGroup": "[parameters('infrastructureResourceGroupName')]"
-                      }
-                    },
-                    "managedEnvironment_roleAssignments": {
-                      "copy": {
-                        "name": "managedEnvironment_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.App/managedEnvironments/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.App/managedEnvironments', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "managedEnvironment"
-                      ]
-                    },
-                    "managedEnvironment_lock": {
-                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                      "type": "Microsoft.Authorization/locks",
-                      "apiVersion": "2020-05-01",
-                      "scope": "[format('Microsoft.App/managedEnvironments/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                      "properties": {
-                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-                      },
-                      "dependsOn": [
-                        "managedEnvironment"
-                      ]
-                    },
-                    "managedEnvironment_certificate": {
-                      "condition": "[not(empty(parameters('certificate')))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-Managed-Environment-Certificate', uniqueString(deployment().name))]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[coalesce(tryGet(parameters('certificate'), 'name'), format('cert-{0}', parameters('name')))]"
-                          },
-                          "managedEnvironmentName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "certificateKeyVaultProperties": {
-                            "value": "[tryGet(parameters('certificate'), 'certificateKeyVaultProperties')]"
-                          },
-                          "certificateType": {
-                            "value": "[tryGet(parameters('certificate'), 'certificateType')]"
-                          },
-                          "certificateValue": {
-                            "value": "[tryGet(parameters('certificate'), 'certificateValue')]"
-                          },
-                          "certificatePassword": {
-                            "value": "[tryGet(parameters('certificate'), 'certificatePassword')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.35.1.17967",
-                              "templateHash": "18123249047188753287"
-                            },
-                            "name": "App ManagedEnvironments Certificates",
-                            "description": "This module deploys a App Managed Environment Certificate."
-                          },
-                          "definitions": {
-                            "certificateKeyVaultPropertiesType": {
-                              "type": "object",
-                              "properties": {
-                                "identityResourceId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The resource ID of the identity. This is the identity that will be used to access the key vault."
-                                  }
-                                },
-                                "keyVaultUrl": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. A key vault URL referencing the wildcard certificate that will be used for the custom domain."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true,
-                                "description": "The type for the certificate's key vault properties."
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the Container Apps Managed Environment Certificate."
-                              }
-                            },
-                            "managedEnvironmentName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent app managed environment. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "location": {
-                              "type": "string",
-                              "defaultValue": "[resourceGroup().location]",
-                              "metadata": {
-                                "description": "Optional. Location for all Resources."
-                              }
-                            },
-                            "certificateKeyVaultProperties": {
-                              "$ref": "#/definitions/certificateKeyVaultPropertiesType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. A key vault reference to the certificate to use for the custom domain."
-                              }
-                            },
-                            "certificateType": {
-                              "type": "string",
-                              "nullable": true,
-                              "allowedValues": [
-                                "ServerSSLCertificate",
-                                "ImagePullTrustedCA"
-                              ],
-                              "metadata": {
-                                "description": "Optional. The type of the certificate."
-                              }
-                            },
-                            "certificateValue": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The value of the certificate. PFX or PEM blob."
-                              }
-                            },
-                            "certificatePassword": {
-                              "type": "securestring",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The password of the certificate."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Tags of the resource."
-                              }
-                            }
-                          },
-                          "resources": {
-                            "managedEnvironment": {
-                              "existing": true,
-                              "type": "Microsoft.App/managedEnvironments",
-                              "apiVersion": "2024-10-02-preview",
-                              "name": "[parameters('managedEnvironmentName')]"
-                            },
-                            "managedEnvironmentCertificate": {
-                              "type": "Microsoft.App/managedEnvironments/certificates",
-                              "apiVersion": "2024-10-02-preview",
-                              "name": "[format('{0}/{1}', parameters('managedEnvironmentName'), parameters('name'))]",
-                              "location": "[parameters('location')]",
-                              "properties": {
-                                "certificateKeyVaultProperties": "[if(not(empty(parameters('certificateKeyVaultProperties'))), createObject('identity', parameters('certificateKeyVaultProperties').identityResourceId, 'keyVaultUrl', parameters('certificateKeyVaultProperties').keyVaultUrl), null())]",
-                                "certificateType": "[parameters('certificateType')]",
-                                "password": "[parameters('certificatePassword')]",
-                                "value": "[parameters('certificateValue')]"
-                              },
-                              "tags": "[parameters('tags')]"
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the key values."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the key values."
-                              },
-                              "value": "[resourceId('Microsoft.App/managedEnvironments/certificates', parameters('managedEnvironmentName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group the batch account was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "managedEnvironment"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the resource group the Managed Environment was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('managedEnvironment', '2024-10-02-preview', 'full').location]"
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the Managed Environment."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the Managed Environment."
-                      },
-                      "value": "[resourceId('Microsoft.App/managedEnvironments', parameters('name'))]"
-                    },
-                    "systemAssignedMIPrincipalId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "The principal ID of the system assigned identity."
-                      },
-                      "value": "[tryGet(tryGet(reference('managedEnvironment', '2024-10-02-preview', 'full'), 'identity'), 'principalId')]"
-                    },
-                    "defaultDomain": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The Default domain of the Managed Environment."
-                      },
-                      "value": "[reference('managedEnvironment').defaultDomain]"
-                    },
-                    "staticIp": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The IP address of the Managed Environment."
-                      },
-                      "value": "[reference('managedEnvironment').staticIp]"
-                    },
-                    "domainVerificationId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The domain verification id for custom domains."
-                      },
-                      "value": "[reference('managedEnvironment').customDomainConfiguration.customDomainVerificationId]"
-                    }
-                  }
-                }
-              }
-            }
-          ],
-          "outputs": {
-            "resourceId": {
-              "type": "string",
-              "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.app.managed-environment.{0}', parameters('name')), 64)), '2022-09-01').outputs.resourceId.value]"
-            },
-            "location": {
-              "type": "string",
-              "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.app.managed-environment.{0}', parameters('name')), 64)), '2022-09-01').outputs.location.value]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "applicationInsights",
-        "logAnalyticsWorkspace",
-        "virtualNetwork"
-      ]
-    },
-    "containerApp": {
-      "condition": "[variables('containerAppEnabled')]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2022-09-01",
-      "name": "[take(format('avm.res.app.container-app.{0}', variables('containerAppResourceName')), 64)]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[variables('containerAppResourceName')]"
-          },
-          "tags": {
-            "value": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'tags'), parameters('tags'))]"
-          },
-          "location": {
-            "value": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'location'), parameters('solutionLocation'))]"
-          },
-          "enableTelemetry": {
-            "value": "[parameters('enableTelemetry')]"
-          },
-          "environmentResourceId": {
-            "value": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'environmentResourceId'), reference('containerAppEnvironment').outputs.resourceId.value)]"
-          },
-          "managedIdentities": {
-            "value": {
-              "systemAssigned": true,
-              "userAssignedResourceIds": [
-                "[reference('userAssignedIdentity').outputs.resourceId.value]"
-              ]
-            }
-          },
-          "ingressTargetPort": {
-            "value": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'ingressTargetPort'), 8000)]"
-          },
-          "ingressExternal": {
-            "value": true
-          },
-          "activeRevisionsMode": {
-            "value": "Single"
-          },
-          "corsPolicy": {
-            "value": {
-              "allowedOrigins": [
-                "[format('https://{0}.azurewebsites.net', variables('webSiteName'))]",
-                "[format('http://{0}.azurewebsites.net', variables('webSiteName'))]"
-              ]
-            }
-          },
-          "scaleSettings": {
-            "value": {
-              "maxReplicas": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'maxReplicas'), 1)]",
-              "minReplicas": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'minReplicas'), 1)]",
-              "rules": [
-                {
-                  "name": "http-scaler",
-                  "http": {
-                    "metadata": {
-                      "concurrentRequests": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'concurrentRequests'), '100')]"
-                    }
-                  }
-                }
-              ]
-            }
-          },
-          "containers": {
-            "value": [
-              {
-                "name": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'containerName'), 'backend')]",
-                "image": "[format('{0}/{1}:{2}', coalesce(tryGet(parameters('containerAppConfiguration'), 'containerImageRegistryDomain'), 'biabcontainerreg.azurecr.io'), coalesce(tryGet(parameters('containerAppConfiguration'), 'containerImageName'), 'macaebackend'), coalesce(tryGet(parameters('containerAppConfiguration'), 'containerImageTag'), 'latest'))]",
-                "resources": {
-                  "cpu": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'containerCpu'), '2.0')]",
-                  "memory": "[coalesce(tryGet(parameters('containerAppConfiguration'), 'containerMemory'), '4.0Gi')]"
-                },
-                "env": [
-                  {
-                    "name": "COSMOSDB_ENDPOINT",
-                    "value": "[format('https://{0}.documents.azure.com:443/', variables('cosmosDbResourceName'))]"
-                  },
-                  {
-                    "name": "COSMOSDB_DATABASE",
-                    "value": "[variables('cosmosDbDatabaseName')]"
-                  },
-                  {
-                    "name": "COSMOSDB_CONTAINER",
-                    "value": "[variables('cosmosDbDatabaseMemoryContainerName')]"
-                  },
-                  {
-                    "name": "AZURE_OPENAI_ENDPOINT",
-                    "value": "[format('https://{0}.openai.azure.com/', variables('aiFoundryAiServicesResourceName'))]"
-                  },
-                  {
-                    "name": "AZURE_OPENAI_MODEL_NAME",
-                    "value": "[variables('aiFoundryAiServicesModelDeployment').name]"
-                  },
-                  {
-                    "name": "AZURE_OPENAI_DEPLOYMENT_NAME",
-                    "value": "[variables('aiFoundryAiServicesModelDeployment').name]"
-                  },
-                  {
-                    "name": "AZURE_OPENAI_API_VERSION",
-                    "value": "2025-01-01-preview"
-                  },
-                  {
-                    "name": "APPLICATIONINSIGHTS_INSTRUMENTATION_KEY",
-                    "value": "[reference('applicationInsights').outputs.instrumentationKey.value]"
-                  },
-                  {
-                    "name": "APPLICATIONINSIGHTS_CONNECTION_STRING",
-                    "value": "[reference('applicationInsights').outputs.connectionString.value]"
-                  },
-                  {
-                    "name": "AZURE_AI_SUBSCRIPTION_ID",
-                    "value": "[subscription().subscriptionId]"
-                  },
-                  {
-                    "name": "AZURE_AI_RESOURCE_GROUP",
-                    "value": "[resourceGroup().name]"
-                  },
-                  {
-                    "name": "AZURE_AI_PROJECT_NAME",
-                    "value": "[variables('aiFoundryAiProjectName')]"
-                  },
-                  {
-                    "name": "FRONTEND_SITE_NAME",
-                    "value": "[format('https://{0}.azurewebsites.net', variables('webSiteName'))]"
-                  },
-                  {
-                    "name": "AZURE_AI_AGENT_ENDPOINT",
-                    "value": "[reference('aiFoundryProject').endpoints['AI Foundry API']]"
-                  },
-                  {
-                    "name": "AZURE_AI_AGENT_MODEL_DEPLOYMENT_NAME",
-                    "value": "[variables('aiFoundryAiServicesModelDeployment').name]"
-                  }
-                ]
-              }
-            ]
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.34.44.8038",
-              "templateHash": "18305799083153878117"
-            },
-            "name": "Container Apps",
-            "description": "This module deploys a Container App."
-          },
-          "definitions": {
-            "containerType": {
-              "type": "object",
-              "properties": {
-                "args": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Container start command arguments."
-                  }
-                },
-                "command": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Container start command."
-                  }
-                },
-                "env": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/environmentVarType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Container environment variables."
-                  }
-                },
-                "image": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Container image tag."
-                  }
-                },
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Custom container name."
-                  }
-                },
-                "probes": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/containerAppProbeType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. List of probes for the container."
-                  }
-                },
-                "resources": {
-                  "type": "object",
-                  "metadata": {
-                    "description": "Required. Container resource requirements."
-                  }
-                },
-                "volumeMounts": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/volumeMountType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Container volume mounts."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for a container."
-              }
-            },
-            "ingressPortMappingType": {
-              "type": "object",
-              "properties": {
-                "exposedPort": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specifies the exposed port for the target port. If not specified, it defaults to target port."
-                  }
-                },
-                "external": {
-                  "type": "bool",
-                  "metadata": {
-                    "description": "Required. Specifies whether the app port is accessible outside of the environment."
-                  }
-                },
-                "targetPort": {
-                  "type": "int",
-                  "metadata": {
-                    "description": "Required. Specifies the port the container listens on."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for an ingress port mapping."
-              }
-            },
-            "serviceBindingType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the service."
-                  }
-                },
-                "serviceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The service ID."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "The type for a service binding."
-              }
-            },
-            "environmentVarType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Environment variable name."
-                  }
-                },
-                "secretRef": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Name of the Container App secret from which to pull the environment variable value."
-                  }
-                },
-                "value": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Non-secret environment variable value."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for an environment variable."
-              }
-            },
-            "containerAppProbeType": {
-              "type": "object",
-              "properties": {
-                "failureThreshold": {
-                  "type": "int",
-                  "nullable": true,
-                  "minValue": 1,
-                  "maxValue": 10,
-                  "metadata": {
-                    "description": "Optional. Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3."
-                  }
-                },
-                "httpGet": {
-                  "$ref": "#/definitions/containerAppProbeHttpGetType",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. HTTPGet specifies the http request to perform."
-                  }
-                },
-                "initialDelaySeconds": {
-                  "type": "int",
-                  "nullable": true,
-                  "minValue": 1,
-                  "maxValue": 60,
-                  "metadata": {
-                    "description": "Optional. Number of seconds after the container has started before liveness probes are initiated."
-                  }
-                },
-                "periodSeconds": {
-                  "type": "int",
-                  "nullable": true,
-                  "minValue": 1,
-                  "maxValue": 240,
-                  "metadata": {
-                    "description": "Optional. How often (in seconds) to perform the probe. Default to 10 seconds."
-                  }
-                },
-                "successThreshold": {
-                  "type": "int",
-                  "nullable": true,
-                  "minValue": 1,
-                  "maxValue": 10,
-                  "metadata": {
-                    "description": "Optional. Minimum consecutive successes for the probe to be considered successful after having failed. Defaults to 1. Must be 1 for liveness and startup."
-                  }
-                },
-                "tcpSocket": {
-                  "$ref": "#/definitions/containerAppProbeTcpSocketType",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The TCP socket specifies an action involving a TCP port. TCP hooks not yet supported."
-                  }
-                },
-                "terminationGracePeriodSeconds": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Optional duration in seconds the pod needs to terminate gracefully upon probe failure. The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this value overrides the value provided by the pod spec. Value must be non-negative integer. The value zero indicates stop immediately via the kill signal (no opportunity to shut down). This is an alpha field and requires enabling ProbeTerminationGracePeriod feature gate. Maximum value is 3600 seconds (1 hour)."
-                  }
-                },
-                "timeoutSeconds": {
-                  "type": "int",
-                  "nullable": true,
-                  "minValue": 1,
-                  "maxValue": 240,
-                  "metadata": {
-                    "description": "Optional. Number of seconds after which the probe times out. Defaults to 1 second."
-                  }
-                },
-                "type": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Liveness",
-                    "Readiness",
-                    "Startup"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The type of probe."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "The type for a container app probe."
-              }
-            },
-            "corsPolicyType": {
-              "type": "object",
-              "properties": {
-                "allowCredentials": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Switch to determine whether the resource allows credentials."
-                  }
-                },
-                "allowedHeaders": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specifies the content for the access-control-allow-headers header."
-                  }
-                },
-                "allowedMethods": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specifies the content for the access-control-allow-methods header."
-                  }
-                },
-                "allowedOrigins": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specifies the content for the access-control-allow-origins header."
-                  }
-                },
-                "exposeHeaders": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specifies the content for the access-control-expose-headers header."
-                  }
-                },
-                "maxAge": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specifies the content for the access-control-max-age header."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for a CORS policy."
-              }
-            },
-            "containerAppProbeHttpGetType": {
-              "type": "object",
-              "properties": {
-                "host": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Host name to connect to. Defaults to the pod IP."
-                  }
-                },
-                "httpHeaders": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/containerAppProbeHttpGetHeadersItemType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. HTTP headers to set in the request."
-                  }
-                },
-                "path": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Path to access on the HTTP server."
-                  }
-                },
-                "port": {
-                  "type": "int",
-                  "metadata": {
-                    "description": "Required. Name or number of the port to access on the container."
-                  }
-                },
-                "scheme": {
-                  "type": "string",
-                  "allowedValues": [
-                    "HTTP",
-                    "HTTPS"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Scheme to use for connecting to the host. Defaults to HTTP."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "The type for a container app probe HTTP GET."
-              }
-            },
-            "containerAppProbeHttpGetHeadersItemType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Name of the header."
-                  }
-                },
-                "value": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Value of the header."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "The type for a container app probe HTTP GET header."
-              }
-            },
-            "containerAppProbeTcpSocketType": {
-              "type": "object",
-              "properties": {
-                "host": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Host name to connect to, defaults to the pod IP."
-                  }
-                },
-                "port": {
-                  "type": "int",
-                  "minValue": 1,
-                  "maxValue": 65535,
-                  "metadata": {
-                    "description": "Required. Number of the port to access on the container. Name must be an IANA_SVC_NAME."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "The type for a container app probe TCP socket."
-              }
-            },
-            "scaleType": {
-              "type": "object",
-              "properties": {
-                "maxReplicas": {
-                  "type": "int",
-                  "metadata": {
-                    "description": "Required. The maximum number of replicas."
-                  }
-                },
-                "minReplicas": {
-                  "type": "int",
-                  "metadata": {
-                    "description": "Required. The minimum number of replicas."
-                  }
-                },
-                "cooldownPeriod": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The cooldown period in seconds."
-                  }
-                },
-                "pollingInterval": {
-                  "type": "int",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The polling interval in seconds."
-                  }
-                },
-                "rules": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/scaleRuleType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The scaling rules."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "The scale settings for the Container App."
-              }
-            },
-            "scaleRuleType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the scaling rule."
-                  }
-                },
-                "custom": {
-                  "type": "object",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The custom scaling rule."
-                  }
-                },
-                "azureQueue": {
-                  "type": "object",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The Azure Queue based scaling rule."
-                  }
-                },
-                "http": {
-                  "type": "object",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The HTTP requests based scaling rule."
-                  }
-                },
-                "tcp": {
-                  "type": "object",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The TCP based scaling rule."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "The scaling rules for the Container App."
-              }
-            },
-            "volumeMountType": {
-              "type": "object",
-              "properties": {
-                "mountPath": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Path within the container at which the volume should be mounted.Must not contain ':'."
-                  }
-                },
-                "subPath": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Path within the volume from which the container's volume should be mounted. Defaults to \"\" (volume's root)."
-                  }
-                },
-                "volumeName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. This must match the Name of a Volume."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "The type for a volume mount."
-              }
-            },
-            "runtimeType": {
-              "type": "object",
-              "properties": {
-                "dotnet": {
-                  "type": "object",
-                  "properties": {
-                    "autoConfigureDataProtection": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Enable to auto configure the ASP.NET Core Data Protection feature."
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Runtime configuration for ASP.NET Core."
-                  }
-                },
-                "java": {
-                  "type": "object",
-                  "properties": {
-                    "enableMetrics": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Enable JMX core metrics for the Java app."
-                      }
-                    },
-                    "enableJavaAgent": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Enable Java agent injection for the Java app."
-                      }
-                    },
-                    "loggerSettings": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "logger": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. Name of the logger."
-                            }
-                          },
-                          "level": {
-                            "type": "string",
-                            "allowedValues": [
-                              "debug",
-                              "error",
-                              "info",
-                              "off",
-                              "trace",
-                              "warn"
-                            ],
-                            "metadata": {
-                              "description": "Required. Java agent logging level."
-                            }
-                          }
-                        }
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Java agent logging configuration."
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Runtime configuration for Java."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "Optional. App runtime configuration for the Container App."
-              }
-            },
-            "secretType": {
-              "type": "object",
-              "properties": {
-                "identity": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of a managed identity to authenticate with Azure Key Vault, or System to use a system-assigned identity."
-                  }
-                },
-                "keyVaultUrl": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Conditional. The URL of the Azure Key Vault secret referenced by the Container App. Required if `value` is null."
-                  }
-                },
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the container app secret."
-                  }
-                },
-                "value": {
-                  "type": "securestring",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Conditional. The container app secret value, if not fetched from the Key Vault. Required if `keyVaultUrl` is not null."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for a secret."
-              }
-            },
-            "lockType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of lock."
-                  }
-                },
-                "kind": {
-                  "type": "string",
-                  "allowedValues": [
-                    "CanNotDelete",
-                    "None",
-                    "ReadOnly"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a lock.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
-                }
-              }
-            },
-            "managedIdentityAllType": {
-              "type": "object",
-              "properties": {
-                "systemAssigned": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Enables system assigned managed identity on the resource."
-                  }
-                },
-                "userAssignedResourceIds": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
-                }
-              }
-            },
-            "roleAssignmentType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                  }
-                },
-                "roleDefinitionIdOrName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                  }
-                },
-                "principalId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                  }
-                },
-                "principalType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Device",
-                    "ForeignGroup",
-                    "Group",
-                    "ServicePrincipal",
-                    "User"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The principal type of the assigned principal ID."
-                  }
-                },
-                "description": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The description of the role assignment."
-                  }
-                },
-                "condition": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                  }
-                },
-                "conditionVersion": {
-                  "type": "string",
-                  "allowedValues": [
-                    "2.0"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Version of the condition."
-                  }
-                },
-                "delegatedManagedIdentityResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a role assignment.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
-                }
-              }
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. Name of the Container App."
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional. Location for all Resources."
-              }
-            },
-            "disableIngress": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Bool to disable all ingress traffic for the container app."
-              }
-            },
-            "ingressExternal": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Bool indicating if the App exposes an external HTTP endpoint."
-              }
-            },
-            "clientCertificateMode": {
-              "type": "string",
-              "defaultValue": "ignore",
-              "allowedValues": [
-                "accept",
-                "ignore",
-                "require"
-              ],
-              "metadata": {
-                "description": "Optional. Client certificate mode for mTLS."
-              }
-            },
-            "corsPolicy": {
-              "$ref": "#/definitions/corsPolicyType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Object userd to configure CORS policy."
-              }
-            },
-            "stickySessionsAffinity": {
-              "type": "string",
-              "defaultValue": "none",
-              "allowedValues": [
-                "none",
-                "sticky"
-              ],
-              "metadata": {
-                "description": "Optional. Bool indicating if the Container App should enable session affinity."
-              }
-            },
-            "ingressTransport": {
-              "type": "string",
-              "defaultValue": "auto",
-              "allowedValues": [
-                "auto",
-                "http",
-                "http2",
-                "tcp"
-              ],
-              "metadata": {
-                "description": "Optional. Ingress transport protocol."
-              }
-            },
-            "service": {
-              "type": "object",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Optional. Dev ContainerApp service type."
-              }
-            },
-            "includeAddOns": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Toggle to include the service configuration."
-              }
-            },
-            "additionalPortMappings": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/ingressPortMappingType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Settings to expose additional ports on container app."
-              }
-            },
-            "ingressAllowInsecure": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Bool indicating if HTTP connections to is allowed. If set to false HTTP connections are automatically redirected to HTTPS connections."
-              }
-            },
-            "ingressTargetPort": {
-              "type": "int",
-              "defaultValue": 80,
-              "metadata": {
-                "description": "Optional. Target Port in containers for traffic from ingress."
-              }
-            },
-            "scaleSettings": {
-              "$ref": "#/definitions/scaleType",
-              "defaultValue": {
-                "maxReplicas": 10,
-                "minReplicas": 3
-              },
-              "metadata": {
-                "description": "Optional. The scaling settings of the service."
-              }
-            },
-            "serviceBinds": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/serviceBindingType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. List of container app services bound to the app."
-              }
-            },
-            "activeRevisionsMode": {
-              "type": "string",
-              "defaultValue": "Single",
-              "allowedValues": [
-                "Multiple",
-                "Single"
-              ],
-              "metadata": {
-                "description": "Optional. Controls how active revisions are handled for the Container app."
-              }
-            },
-            "environmentResourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. Resource ID of environment."
-              }
-            },
-            "lock": {
-              "$ref": "#/definitions/lockType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The lock settings of the service."
-              }
-            },
-            "tags": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Tags of the resource."
-              }
-            },
-            "registries": {
-              "type": "array",
-              "defaultValue": [],
-              "metadata": {
-                "description": "Optional. Collection of private container registry credentials for containers used by the Container app."
-              }
-            },
-            "managedIdentities": {
-              "$ref": "#/definitions/managedIdentityAllType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The managed identity definition for this resource."
-              }
-            },
-            "roleAssignments": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/roleAssignmentType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of role assignments to create."
-              }
-            },
-            "enableTelemetry": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Enable/Disable usage telemetry for module."
-              }
-            },
-            "customDomains": {
-              "type": "array",
-              "defaultValue": [],
-              "metadata": {
-                "description": "Optional. Custom domain bindings for Container App hostnames."
-              }
-            },
-            "exposedPort": {
-              "type": "int",
-              "defaultValue": 0,
-              "metadata": {
-                "description": "Optional. Exposed Port in containers for TCP traffic from ingress."
-              }
-            },
-            "ipSecurityRestrictions": {
-              "type": "array",
-              "defaultValue": [],
-              "metadata": {
-                "description": "Optional. Rules to restrict incoming IP address."
-              }
-            },
-            "trafficLabel": {
-              "type": "string",
-              "defaultValue": "label-1",
-              "metadata": {
-                "description": "Optional. Associates a traffic label with a revision. Label name should be consist of lower case alphanumeric characters or dashes."
-              }
-            },
-            "trafficLatestRevision": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Indicates that the traffic weight belongs to a latest stable revision."
-              }
-            },
-            "trafficRevisionName": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. Name of a revision."
-              }
-            },
-            "trafficWeight": {
-              "type": "int",
-              "defaultValue": 100,
-              "metadata": {
-                "description": "Optional. Traffic weight assigned to a revision."
-              }
-            },
-            "dapr": {
-              "type": "object",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Optional. Dapr configuration for the Container App."
-              }
-            },
-            "maxInactiveRevisions": {
-              "type": "int",
-              "defaultValue": 0,
-              "metadata": {
-                "description": "Optional. Max inactive revisions a Container App can have."
-              }
-            },
-            "runtime": {
-              "$ref": "#/definitions/runtimeType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Runtime configuration for the Container App."
-              }
-            },
-            "containers": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/containerType"
-              },
-              "metadata": {
-                "description": "Required. List of container definitions for the Container App."
-              }
-            },
-            "initContainersTemplate": {
-              "type": "array",
-              "defaultValue": [],
-              "metadata": {
-                "description": "Optional. List of specialized containers that run before app containers."
-              }
-            },
-            "secrets": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/secretType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The secrets of the Container App."
-              }
-            },
-            "revisionSuffix": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. User friendly suffix that is appended to the revision name."
-              }
-            },
-            "volumes": {
-              "type": "array",
-              "defaultValue": [],
-              "metadata": {
-                "description": "Optional. List of volume definitions for the Container App."
-              }
-            },
-            "workloadProfileName": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. Workload profile name to pin for container app execution."
-              }
-            }
-          },
-          "variables": {
-            "copy": [
-              {
-                "name": "formattedRoleAssignments",
-                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-              }
-            ],
-            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
-            "builtInRoleNames": {
-              "ContainerApp Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ad2dd5fb-cd4b-4fd4-a9b6-4fed3630980b')]",
-              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-            }
-          },
-          "resources": {
-            "avmTelemetry": {
-              "condition": "[parameters('enableTelemetry')]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.app-containerapp.{0}.{1}', replace('0.14.2', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-              "properties": {
-                "mode": "Incremental",
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "resources": [],
-                  "outputs": {
-                    "telemetry": {
-                      "type": "String",
-                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                    }
-                  }
-                }
-              }
-            },
-            "containerApp": {
-              "type": "Microsoft.App/containerApps",
-              "apiVersion": "2024-10-02-preview",
-              "name": "[parameters('name')]",
-              "tags": "[parameters('tags')]",
-              "location": "[parameters('location')]",
-              "identity": "[variables('identity')]",
-              "properties": {
-                "environmentId": "[parameters('environmentResourceId')]",
-                "configuration": {
-                  "activeRevisionsMode": "[parameters('activeRevisionsMode')]",
-                  "dapr": "[if(not(empty(parameters('dapr'))), parameters('dapr'), null())]",
-                  "ingress": "[if(parameters('disableIngress'), null(), createObject('additionalPortMappings', parameters('additionalPortMappings'), 'allowInsecure', if(not(equals(parameters('ingressTransport'), 'tcp')), parameters('ingressAllowInsecure'), false()), 'customDomains', if(not(empty(parameters('customDomains'))), parameters('customDomains'), null()), 'corsPolicy', if(and(not(equals(parameters('corsPolicy'), null())), not(equals(parameters('ingressTransport'), 'tcp'))), createObject('allowCredentials', coalesce(tryGet(parameters('corsPolicy'), 'allowCredentials'), false()), 'allowedHeaders', coalesce(tryGet(parameters('corsPolicy'), 'allowedHeaders'), createArray()), 'allowedMethods', coalesce(tryGet(parameters('corsPolicy'), 'allowedMethods'), createArray()), 'allowedOrigins', coalesce(tryGet(parameters('corsPolicy'), 'allowedOrigins'), createArray()), 'exposeHeaders', coalesce(tryGet(parameters('corsPolicy'), 'exposeHeaders'), createArray()), 'maxAge', tryGet(parameters('corsPolicy'), 'maxAge')), null()), 'clientCertificateMode', if(not(equals(parameters('ingressTransport'), 'tcp')), parameters('clientCertificateMode'), null()), 'exposedPort', parameters('exposedPort'), 'external', parameters('ingressExternal'), 'ipSecurityRestrictions', if(not(empty(parameters('ipSecurityRestrictions'))), parameters('ipSecurityRestrictions'), null()), 'targetPort', parameters('ingressTargetPort'), 'stickySessions', createObject('affinity', parameters('stickySessionsAffinity')), 'traffic', if(not(equals(parameters('ingressTransport'), 'tcp')), createArray(createObject('label', parameters('trafficLabel'), 'latestRevision', parameters('trafficLatestRevision'), 'revisionName', parameters('trafficRevisionName'), 'weight', parameters('trafficWeight'))), null()), 'transport', parameters('ingressTransport')))]",
-                  "service": "[if(and(parameters('includeAddOns'), not(empty(parameters('service')))), parameters('service'), null())]",
-                  "maxInactiveRevisions": "[parameters('maxInactiveRevisions')]",
-                  "registries": "[if(not(empty(parameters('registries'))), parameters('registries'), null())]",
-                  "secrets": "[parameters('secrets')]",
-                  "runtime": {
-                    "dotnet": "[if(not(empty(tryGet(parameters('runtime'), 'dotnet'))), createObject('autoConfigureDataProtection', tryGet(parameters('runtime'), 'dotnet', 'autoConfigureDataProtection')), null())]",
-                    "java": "[if(not(empty(tryGet(parameters('runtime'), 'java'))), createObject('enableMetrics', tryGet(parameters('runtime'), 'java', 'enableMetrics'), 'javaAgent', createObject('enabled', tryGet(parameters('runtime'), 'java', 'enableJavaAgent'), 'logging', createObject('loggerSettings', tryGet(tryGet(parameters('runtime'), 'java'), 'loggerSettings')))), null())]"
-                  }
-                },
-                "template": {
-                  "containers": "[parameters('containers')]",
-                  "initContainers": "[if(not(empty(parameters('initContainersTemplate'))), parameters('initContainersTemplate'), null())]",
-                  "revisionSuffix": "[parameters('revisionSuffix')]",
-                  "scale": "[parameters('scaleSettings')]",
-                  "serviceBinds": "[if(and(parameters('includeAddOns'), not(empty(parameters('serviceBinds')))), parameters('serviceBinds'), null())]",
-                  "volumes": "[if(not(empty(parameters('volumes'))), parameters('volumes'), null())]"
-                },
-                "workloadProfileName": "[parameters('workloadProfileName')]"
-              }
-            },
-            "containerApp_lock": {
-              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-              "type": "Microsoft.Authorization/locks",
-              "apiVersion": "2020-05-01",
-              "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-              "properties": {
-                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-              },
-              "dependsOn": [
-                "containerApp"
-              ]
-            },
-            "containerApp_roleAssignments": {
-              "copy": {
-                "name": "containerApp_roleAssignments",
-                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-              },
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.App/containerApps', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-              "properties": {
-                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-              },
-              "dependsOn": [
-                "containerApp"
-              ]
-            }
-          },
-          "outputs": {
-            "resourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource ID of the Container App."
-              },
-              "value": "[resourceId('Microsoft.App/containerApps', parameters('name'))]"
-            },
-            "fqdn": {
-              "type": "string",
-              "metadata": {
-                "description": "The configuration of ingress fqdn."
-              },
-              "value": "[if(parameters('disableIngress'), 'IngressDisabled', reference('containerApp').configuration.ingress.fqdn)]"
-            },
-            "resourceGroupName": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the resource group the Container App was deployed into."
-              },
-              "value": "[resourceGroup().name]"
-            },
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the Container App."
-              },
-              "value": "[parameters('name')]"
-            },
-            "systemAssignedMIPrincipalId": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "The principal ID of the system assigned identity."
-              },
-              "value": "[tryGet(tryGet(reference('containerApp', '2024-10-02-preview', 'full'), 'identity'), 'principalId')]"
-            },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "The location the resource was deployed into."
-              },
-              "value": "[reference('containerApp', '2024-10-02-preview', 'full').location]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "aiFoundryProject",
-        "applicationInsights",
-        "containerAppEnvironment",
-        "userAssignedIdentity"
-      ]
-    },
-    "webServerFarm": {
-      "condition": "[variables('webServerFarmEnabled')]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2022-09-01",
-      "name": "[take(format('avm.res.web.serverfarm.{0}', variables('webServerFarmResourceName')), 64)]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[variables('webServerFarmResourceName')]"
-          },
-          "tags": {
-            "value": "[parameters('tags')]"
-          },
-          "location": {
-            "value": "[coalesce(tryGet(parameters('webServerFarmConfiguration'), 'location'), parameters('solutionLocation'))]"
-          },
-          "skuName": {
-            "value": "[coalesce(tryGet(parameters('webServerFarmConfiguration'), 'skuName'), 'P1v3')]"
-          },
-          "skuCapacity": {
-            "value": "[coalesce(tryGet(parameters('webServerFarmConfiguration'), 'skuCapacity'), 3)]"
-          },
-          "reserved": {
-            "value": true
-          },
-          "diagnosticSettings": {
-            "value": [
-              {
-                "workspaceResourceId": "[if(variables('useExistingWorkspace'), variables('existingWorkspaceResourceId'), listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId)]"
-              }
-            ]
-          },
-          "kind": {
-            "value": "linux"
-          },
-          "zoneRedundant": {
-            "value": false
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.32.4.45862",
-              "templateHash": "13070013363315850466"
-            },
-            "name": "App Service Plan",
-            "description": "This module deploys an App Service Plan.",
-            "owner": "Azure/module-maintainers"
-          },
-          "definitions": {
-            "diagnosticSettingMetricsOnlyType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of diagnostic setting."
-                  }
-                },
-                "metricCategories": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                        }
-                      },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                  }
-                },
-                "logAnalyticsDestinationType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "AzureDiagnostics",
-                    "Dedicated"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                  }
-                },
-                "workspaceResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "storageAccountResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "eventHubAuthorizationRuleResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                  }
-                },
-                "eventHubName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "marketplacePartnerResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a diagnostic setting. To be used if only metrics are supported by the resource provider.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
-                }
-              }
-            },
-            "lockType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of lock."
-                  }
-                },
-                "kind": {
-                  "type": "string",
-                  "allowedValues": [
-                    "CanNotDelete",
-                    "None",
-                    "ReadOnly"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a lock.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
-                }
-              }
-            },
-            "roleAssignmentType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                  }
-                },
-                "roleDefinitionIdOrName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                  }
-                },
-                "principalId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                  }
-                },
-                "principalType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Device",
-                    "ForeignGroup",
-                    "Group",
-                    "ServicePrincipal",
-                    "User"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The principal type of the assigned principal ID."
-                  }
-                },
-                "description": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The description of the role assignment."
-                  }
-                },
-                "condition": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                  }
-                },
-                "conditionVersion": {
-                  "type": "string",
-                  "allowedValues": [
-                    "2.0"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Version of the condition."
-                  }
-                },
-                "delegatedManagedIdentityResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a role assignment.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
-                }
-              }
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "minLength": 1,
-              "maxLength": 60,
-              "metadata": {
-                "description": "Required. Name of the app service plan."
-              }
-            },
-            "skuName": {
-              "type": "string",
-              "defaultValue": "P1v3",
-              "metadata": {
-                "example": "  'F1'\n  'B1'\n  'P1v3'\n  'I1v2'\n  'FC1'\n  ",
-                "description": "Optional. The name of the SKU will Determine the tier, size, family of the App Service Plan. This defaults to P1v3 to leverage availability zones."
-              }
-            },
-            "skuCapacity": {
-              "type": "int",
-              "defaultValue": 3,
-              "metadata": {
-                "description": "Optional. Number of workers associated with the App Service Plan. This defaults to 3, to leverage availability zones."
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional. Location for all resources."
-              }
-            },
-            "kind": {
-              "type": "string",
-              "defaultValue": "app",
-              "allowedValues": [
-                "app",
-                "elastic",
-                "functionApp",
-                "windows",
-                "linux"
-              ],
-              "metadata": {
-                "description": "Optional. Kind of server OS."
-              }
-            },
-            "reserved": {
-              "type": "bool",
-              "defaultValue": "[equals(parameters('kind'), 'linux')]",
-              "metadata": {
-                "description": "Conditional. Defaults to false when creating Windows/app App Service Plan. Required if creating a Linux App Service Plan and must be set to true."
-              }
-            },
-            "appServiceEnvironmentId": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. The Resource ID of the App Service Environment to use for the App Service Plan."
-              }
-            },
-            "workerTierName": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. Target worker tier assigned to the App Service plan."
-              }
-            },
-            "perSiteScaling": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. If true, apps assigned to this App Service plan can be scaled independently. If false, apps assigned to this App Service plan will scale to all instances of the plan."
-              }
-            },
-            "elasticScaleEnabled": {
-              "type": "bool",
-              "defaultValue": "[greater(parameters('maximumElasticWorkerCount'), 1)]",
-              "metadata": {
-                "description": "Optional. Enable/Disable ElasticScaleEnabled App Service Plan."
-              }
-            },
-            "maximumElasticWorkerCount": {
-              "type": "int",
-              "defaultValue": 1,
-              "metadata": {
-                "description": "Optional. Maximum number of total workers allowed for this ElasticScaleEnabled App Service Plan."
-              }
-            },
-            "targetWorkerCount": {
-              "type": "int",
-              "defaultValue": 0,
-              "metadata": {
-                "description": "Optional. Scaling worker count."
-              }
-            },
-            "targetWorkerSize": {
-              "type": "int",
-              "defaultValue": 0,
-              "allowedValues": [
-                0,
-                1,
-                2
-              ],
-              "metadata": {
-                "description": "Optional. The instance size of the hosting plan (small, medium, or large)."
-              }
-            },
-            "zoneRedundant": {
-              "type": "bool",
-              "defaultValue": "[if(or(startsWith(parameters('skuName'), 'P'), startsWith(parameters('skuName'), 'EP')), true(), false())]",
-              "metadata": {
-                "description": "Optional. Zone Redundant server farms can only be used on Premium or ElasticPremium SKU tiers within ZRS Supported regions (https://learn.microsoft.com/en-us/azure/storage/common/redundancy-regions-zrs)."
-              }
-            },
-            "lock": {
-              "$ref": "#/definitions/lockType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The lock settings of the service."
-              }
-            },
-            "roleAssignments": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/roleAssignmentType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of role assignments to create."
-              }
-            },
-            "tags": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Tags of the resource."
-              }
-            },
-            "enableTelemetry": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Enable/Disable usage telemetry for module."
-              }
-            },
-            "diagnosticSettings": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/diagnosticSettingMetricsOnlyType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The diagnostic settings of the service."
-              }
-            }
-          },
-          "variables": {
-            "copy": [
-              {
-                "name": "formattedRoleAssignments",
-                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-              }
-            ],
-            "builtInRoleNames": {
-              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
-              "Web Plan Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b')]",
-              "Website Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'de139f84-1756-47ae-9be6-808fbbe84772')]"
-            }
-          },
-          "resources": {
-            "avmTelemetry": {
-              "condition": "[parameters('enableTelemetry')]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.web-serverfarm.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-              "properties": {
-                "mode": "Incremental",
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "resources": [],
-                  "outputs": {
-                    "telemetry": {
-                      "type": "String",
-                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                    }
-                  }
-                }
-              }
-            },
-            "appServicePlan": {
-              "type": "Microsoft.Web/serverfarms",
-              "apiVersion": "2022-09-01",
-              "name": "[parameters('name')]",
-              "kind": "[parameters('kind')]",
-              "location": "[parameters('location')]",
-              "tags": "[parameters('tags')]",
-              "sku": {
-                "name": "[parameters('skuName')]",
-                "capacity": "[if(equals(parameters('skuName'), 'FC1'), null(), parameters('skuCapacity'))]",
-                "tier": "[if(equals(parameters('skuName'), 'FC1'), 'FlexConsumption', null())]"
-              },
-              "properties": {
-                "workerTierName": "[parameters('workerTierName')]",
-                "hostingEnvironmentProfile": "[if(not(empty(parameters('appServiceEnvironmentId'))), createObject('id', parameters('appServiceEnvironmentId')), null())]",
-                "perSiteScaling": "[parameters('perSiteScaling')]",
-                "maximumElasticWorkerCount": "[parameters('maximumElasticWorkerCount')]",
-                "elasticScaleEnabled": "[parameters('elasticScaleEnabled')]",
-                "reserved": "[parameters('reserved')]",
-                "targetWorkerCount": "[parameters('targetWorkerCount')]",
-                "targetWorkerSizeId": "[parameters('targetWorkerSize')]",
-                "zoneRedundant": "[parameters('zoneRedundant')]"
-              }
-            },
-            "appServicePlan_diagnosticSettings": {
-              "copy": {
-                "name": "appServicePlan_diagnosticSettings",
-                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-              },
-              "type": "Microsoft.Insights/diagnosticSettings",
-              "apiVersion": "2021-05-01-preview",
-              "scope": "[format('Microsoft.Web/serverfarms/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-              "properties": {
-                "copy": [
-                  {
-                    "name": "metrics",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                    "input": {
-                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                      "timeGrain": null
-                    }
-                  }
-                ],
-                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-              },
-              "dependsOn": [
-                "appServicePlan"
-              ]
-            },
-            "appServicePlan_lock": {
-              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-              "type": "Microsoft.Authorization/locks",
-              "apiVersion": "2020-05-01",
-              "scope": "[format('Microsoft.Web/serverfarms/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-              "properties": {
-                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-              },
-              "dependsOn": [
-                "appServicePlan"
-              ]
-            },
-            "appServicePlan_roleAssignments": {
-              "copy": {
-                "name": "appServicePlan_roleAssignments",
-                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-              },
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[format('Microsoft.Web/serverfarms/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Web/serverfarms', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-              "properties": {
-                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-              },
-              "dependsOn": [
-                "appServicePlan"
-              ]
-            }
-          },
-          "outputs": {
-            "resourceGroupName": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource group the app service plan was deployed into."
-              },
-              "value": "[resourceGroup().name]"
-            },
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the app service plan."
-              },
-              "value": "[parameters('name')]"
-            },
-            "resourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource ID of the app service plan."
-              },
-              "value": "[resourceId('Microsoft.Web/serverfarms', parameters('name'))]"
-            },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "The location the resource was deployed into."
-              },
-              "value": "[reference('appServicePlan', '2022-09-01', 'full').location]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "logAnalyticsWorkspace"
-      ]
-    },
-    "webSite": {
-      "condition": "[variables('webSiteEnabled')]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2022-09-01",
-      "name": "[take(format('avm.res.web.site.{0}', variables('webSiteName')), 64)]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[variables('webSiteName')]"
-          },
-          "tags": {
-            "value": "[coalesce(tryGet(parameters('webSiteConfiguration'), 'tags'), parameters('tags'))]"
-          },
-          "location": {
-            "value": "[coalesce(tryGet(parameters('webSiteConfiguration'), 'location'), parameters('solutionLocation'))]"
-          },
-          "kind": {
-            "value": "app,linux,container"
-          },
-          "enableTelemetry": {
-            "value": "[parameters('enableTelemetry')]"
-          },
-          "serverFarmResourceId": {
-            "value": "[coalesce(tryGet(parameters('webSiteConfiguration'), 'environmentResourceId'), tryGet(reference('webServerFarm'), 'outputs').resourceId.value)]"
-          },
-          "appInsightResourceId": {
-            "value": "[reference('applicationInsights').outputs.resourceId.value]"
-          },
-          "diagnosticSettings": {
-            "value": [
-              {
-                "workspaceResourceId": "[if(variables('useExistingWorkspace'), variables('existingWorkspaceResourceId'), listOutputsWithSecureValues(resourceId('Microsoft.Resources/deployments', take(format('avm.res.operational-insights.workspace.{0}', variables('logAnalyticsWorkspaceResourceName')), 64)), '2022-09-01').resourceId)]"
-              }
-            ]
-          },
-          "publicNetworkAccess": {
-            "value": "Enabled"
-          },
-          "siteConfig": {
-            "value": {
-              "linuxFxVersion": "[format('DOCKER|{0}/{1}:{2}', coalesce(tryGet(parameters('webSiteConfiguration'), 'containerImageRegistryDomain'), 'biabcontainerreg.azurecr.io'), coalesce(tryGet(parameters('webSiteConfiguration'), 'containerImageName'), 'macaefrontend'), coalesce(tryGet(parameters('webSiteConfiguration'), 'containerImageTag'), 'latest'))]"
-            }
-          },
-          "appSettingsKeyValuePairs": {
-            "value": {
-              "SCM_DO_BUILD_DURING_DEPLOYMENT": "true",
-              "DOCKER_REGISTRY_SERVER_URL": "[format('https://{0}', coalesce(tryGet(parameters('webSiteConfiguration'), 'containerImageRegistryDomain'), 'biabcontainerreg.azurecr.io'))]",
-              "WEBSITES_PORT": "3000",
-              "WEBSITES_CONTAINER_START_TIME_LIMIT": "1800",
-              "BACKEND_API_URL": "[format('https://{0}', reference('containerApp').outputs.fqdn.value)]",
-              "AUTH_ENABLED": "false"
-            }
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.33.93.31351",
-              "templateHash": "2522527858358792357"
-            },
-            "name": "Web/Function Apps",
-            "description": "This module deploys a Web or Function App."
-          },
-          "definitions": {
-            "privateEndpointOutputType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "The name of the private endpoint."
-                  }
-                },
-                "resourceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "The resource ID of the private endpoint."
-                  }
-                },
-                "groupId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "The group Id for the private endpoint Group."
-                  }
-                },
-                "customDnsConfigs": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "fqdn": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "FQDN that resolves to private endpoint IP address."
-                        }
-                      },
-                      "ipAddresses": {
-                        "type": "array",
-                        "items": {
-                          "type": "string"
-                        },
-                        "metadata": {
-                          "description": "A list of private IP addresses of the private endpoint."
-                        }
-                      }
-                    }
-                  },
-                  "metadata": {
-                    "description": "The custom DNS configurations of the private endpoint."
-                  }
-                },
-                "networkInterfaceResourceIds": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "metadata": {
-                    "description": "The IDs of the network interfaces associated with the private endpoint."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true
-              }
-            },
-            "_1.privateEndpointCustomDnsConfigType": {
-              "type": "object",
-              "properties": {
-                "fqdn": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. FQDN that resolves to private endpoint IP address."
-                  }
-                },
-                "ipAddresses": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "metadata": {
-                    "description": "Required. A list of private IP addresses of the private endpoint."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "_1.privateEndpointIpConfigurationType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the resource that is unique within a resource group."
-                  }
-                },
-                "properties": {
-                  "type": "object",
-                  "properties": {
-                    "groupId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                      }
-                    },
-                    "memberName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
-                      }
-                    },
-                    "privateIPAddress": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                      }
-                    }
-                  },
-                  "metadata": {
-                    "description": "Required. Properties of private endpoint IP configurations."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "_1.privateEndpointPrivateDnsZoneGroupType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the Private DNS Zone Group."
-                  }
-                },
-                "privateDnsZoneGroupConfigs": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "name": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. The name of the private DNS Zone Group config."
-                        }
-                      },
-                      "privateDnsZoneResourceId": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. The resource id of the private DNS zone."
-                        }
-                      }
-                    }
-                  },
-                  "metadata": {
-                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "diagnosticSettingFullType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the diagnostic setting."
-                  }
-                },
-                "logCategoriesAndGroups": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                        }
-                      },
-                      "categoryGroup": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                        }
-                      },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                  }
-                },
-                "metricCategories": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                        }
-                      },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                  }
-                },
-                "logAnalyticsDestinationType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "AzureDiagnostics",
-                    "Dedicated"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                  }
-                },
-                "workspaceResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "storageAccountResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "eventHubAuthorizationRuleResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                  }
-                },
-                "eventHubName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "marketplacePartnerResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "lockType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of lock."
-                  }
-                },
-                "kind": {
-                  "type": "string",
-                  "allowedValues": [
-                    "CanNotDelete",
-                    "None",
-                    "ReadOnly"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a lock.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "managedIdentityAllType": {
-              "type": "object",
-              "properties": {
-                "systemAssigned": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Enables system assigned managed identity on the resource."
-                  }
-                },
-                "userAssignedResourceIds": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "privateEndpointSingleServiceType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the Private Endpoint."
-                  }
-                },
-                "location": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The location to deploy the Private Endpoint to."
-                  }
-                },
-                "privateLinkServiceConnectionName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the private link connection to create."
-                  }
-                },
-                "service": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
-                  }
-                },
-                "subnetResourceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                  }
-                },
-                "resourceGroupResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
-                  }
-                },
-                "privateDnsZoneGroup": {
-                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
-                  }
-                },
-                "isManualConnection": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. If Manual Private Link Connection is required."
-                  }
-                },
-                "manualConnectionRequestMessage": {
-                  "type": "string",
-                  "nullable": true,
-                  "maxLength": 140,
-                  "metadata": {
-                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
-                  }
-                },
-                "customDnsConfigs": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Custom DNS configurations."
-                  }
-                },
-                "ipConfigurations": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
-                  }
-                },
-                "applicationSecurityGroupResourceIds": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
-                  }
-                },
-                "customNetworkInterfaceName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
-                  }
-                },
-                "lock": {
-                  "$ref": "#/definitions/lockType",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                },
-                "roleAssignments": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/roleAssignmentType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Array of role assignments to create."
-                  }
-                },
-                "tags": {
-                  "type": "object",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
-                  }
-                },
-                "enableTelemetry": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Enable/Disable usage telemetry for module."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "roleAssignmentType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                  }
-                },
-                "roleDefinitionIdOrName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                  }
-                },
-                "principalId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                  }
-                },
-                "principalType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Device",
-                    "ForeignGroup",
-                    "Group",
-                    "ServicePrincipal",
-                    "User"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The principal type of the assigned principal ID."
-                  }
-                },
-                "description": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The description of the role assignment."
-                  }
-                },
-                "condition": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                  }
-                },
-                "conditionVersion": {
-                  "type": "string",
-                  "allowedValues": [
-                    "2.0"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Version of the condition."
-                  }
-                },
-                "delegatedManagedIdentityResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a role assignment.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. Name of the site."
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional. Location for all Resources."
-              }
-            },
-            "kind": {
-              "type": "string",
-              "allowedValues": [
-                "functionapp",
-                "functionapp,linux",
-                "functionapp,workflowapp",
-                "functionapp,workflowapp,linux",
-                "functionapp,linux,container",
-                "functionapp,linux,container,azurecontainerapps",
-                "app,linux",
-                "app",
-                "linux,api",
-                "api",
-                "app,linux,container",
-                "app,container,windows"
-              ],
-              "metadata": {
-                "description": "Required. Type of site to deploy."
-              }
-            },
-            "serverFarmResourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. The resource ID of the app service plan to use for the site."
-              }
-            },
-            "managedEnvironmentId": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Azure Resource Manager ID of the customers selected Managed Environment on which to host this app."
-              }
-            },
-            "httpsOnly": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Configures a site to accept only HTTPS requests. Issues redirect for HTTP requests."
-              }
-            },
-            "clientAffinityEnabled": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. If client affinity is enabled."
-              }
-            },
-            "appServiceEnvironmentResourceId": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The resource ID of the app service environment to use for this resource."
-              }
-            },
-            "managedIdentities": {
-              "$ref": "#/definitions/managedIdentityAllType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The managed identity definition for this resource."
-              }
-            },
-            "keyVaultAccessIdentityResourceId": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The resource ID of the assigned identity to be used to access a key vault with."
-              }
-            },
-            "storageAccountRequired": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Checks if Customer provided storage account is required."
-              }
-            },
-            "virtualNetworkSubnetId": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Azure Resource Manager ID of the Virtual network and subnet to be joined by Regional VNET Integration. This must be of the form /subscriptions/{subscriptionName}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}."
-              }
-            },
-            "vnetContentShareEnabled": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. To enable accessing content over virtual network."
-              }
-            },
-            "vnetImagePullEnabled": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. To enable pulling image over Virtual Network."
-              }
-            },
-            "vnetRouteAllEnabled": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Virtual Network Route All enabled. This causes all outbound traffic to have Virtual Network Security Groups and User Defined Routes applied."
-              }
-            },
-            "scmSiteAlsoStopped": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Stop SCM (KUDU) site when the app is stopped."
-              }
-            },
-            "siteConfig": {
-              "type": "object",
-              "defaultValue": {
-                "alwaysOn": true,
-                "minTlsVersion": "1.2",
-                "ftpsState": "FtpsOnly"
-              },
-              "metadata": {
-                "description": "Optional. The site config object. The defaults are set to the following values: alwaysOn: true, minTlsVersion: '1.2', ftpsState: 'FtpsOnly'."
-              }
-            },
-            "functionAppConfig": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The Function App configuration object."
-              }
-            },
-            "storageAccountResourceId": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
-              }
-            },
-            "storageAccountUseIdentityAuthentication": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
-              }
-            },
-            "webConfiguration": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The Site Config, Web settings to deploy."
-              }
-            },
-            "msDeployConfiguration": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The extension MSDeployment configuration."
-              }
-            },
-            "appInsightResourceId": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Resource ID of the app insight to leverage for this resource."
-              }
-            },
-            "appSettingsKeyValuePairs": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The app settings-value pairs except for AzureWebJobsStorage, AzureWebJobsDashboard, APPINSIGHTS_INSTRUMENTATIONKEY and APPLICATIONINSIGHTS_CONNECTION_STRING."
-              }
-            },
-            "authSettingV2Configuration": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The auth settings V2 configuration."
-              }
-            },
-            "lock": {
-              "$ref": "#/definitions/lockType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The lock settings of the service."
-              }
-            },
-            "logsConfiguration": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The logs settings configuration."
-              }
-            },
-            "privateEndpoints": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/privateEndpointSingleServiceType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
-              }
-            },
-            "slots": {
-              "type": "array",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Configuration for deployment slots for an app."
-              }
-            },
-            "tags": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Tags of the resource."
-              }
-            },
-            "enableTelemetry": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Enable/Disable usage telemetry for module."
-              }
-            },
-            "roleAssignments": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/roleAssignmentType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of role assignments to create."
-              }
-            },
-            "diagnosticSettings": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/diagnosticSettingFullType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The diagnostic settings of the service."
-              }
-            },
-            "clientCertEnabled": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. To enable client certificate authentication (TLS mutual authentication)."
-              }
-            },
-            "clientCertExclusionPaths": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Client certificate authentication comma-separated exclusion paths."
-              }
-            },
-            "clientCertMode": {
-              "type": "string",
-              "defaultValue": "Optional",
-              "allowedValues": [
-                "Optional",
-                "OptionalInteractiveUser",
-                "Required"
-              ],
-              "metadata": {
-                "description": "Optional. This composes with ClientCertEnabled setting.\n- ClientCertEnabled=false means ClientCert is ignored.\n- ClientCertEnabled=true and ClientCertMode=Required means ClientCert is required.\n- ClientCertEnabled=true and ClientCertMode=Optional means ClientCert is optional or accepted.\n"
-              }
-            },
-            "cloningInfo": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. If specified during app creation, the app is cloned from a source app."
-              }
-            },
-            "containerSize": {
-              "type": "int",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Size of the function container."
-              }
-            },
-            "dailyMemoryTimeQuota": {
-              "type": "int",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Maximum allowed daily memory-time quota (applicable on dynamic apps only)."
-              }
-            },
-            "enabled": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Setting this value to false disables the app (takes the app offline)."
-              }
-            },
-            "hostNameSslStates": {
-              "type": "array",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Hostname SSL states are used to manage the SSL bindings for app's hostnames."
-              }
-            },
-            "hyperV": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Hyper-V sandbox."
-              }
-            },
-            "redundancyMode": {
-              "type": "string",
-              "defaultValue": "None",
-              "allowedValues": [
-                "ActiveActive",
-                "Failover",
-                "GeoRedundant",
-                "Manual",
-                "None"
-              ],
-              "metadata": {
-                "description": "Optional. Site redundancy mode."
-              }
-            },
-            "basicPublishingCredentialsPolicies": {
-              "type": "array",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The site publishing credential policy names which are associated with the sites."
-              }
-            },
-            "hybridConnectionRelays": {
-              "type": "array",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Names of hybrid connection relays to connect app with."
-              }
-            },
-            "publicNetworkAccess": {
-              "type": "string",
-              "nullable": true,
-              "allowedValues": [
-                "Enabled",
-                "Disabled"
-              ],
-              "metadata": {
-                "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set."
-              }
-            },
-            "e2eEncryptionEnabled": {
-              "type": "bool",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. End to End Encryption Setting."
-              }
-            }
-          },
-          "variables": {
-            "copy": [
-              {
-                "name": "formattedRoleAssignments",
-                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-              }
-            ],
-            "enableReferencedModulesTelemetry": false,
-            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
-            "builtInRoleNames": {
-              "App Compliance Automation Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f37683f-2463-46b6-9ce7-9b788b988ba2')]",
-              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
-              "Web Plan Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b')]",
-              "Website Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'de139f84-1756-47ae-9be6-808fbbe84772')]"
-            }
-          },
-          "resources": {
-            "avmTelemetry": {
-              "condition": "[parameters('enableTelemetry')]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.web-site.{0}.{1}', replace('0.15.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-              "properties": {
-                "mode": "Incremental",
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "resources": [],
-                  "outputs": {
-                    "telemetry": {
-                      "type": "String",
-                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                    }
-                  }
-                }
-              }
-            },
-            "app": {
-              "type": "Microsoft.Web/sites",
-              "apiVersion": "2024-04-01",
-              "name": "[parameters('name')]",
-              "location": "[parameters('location')]",
-              "kind": "[parameters('kind')]",
-              "tags": "[parameters('tags')]",
-              "identity": "[variables('identity')]",
-              "properties": {
-                "managedEnvironmentId": "[if(not(empty(parameters('managedEnvironmentId'))), parameters('managedEnvironmentId'), null())]",
-                "serverFarmId": "[parameters('serverFarmResourceId')]",
-                "clientAffinityEnabled": "[parameters('clientAffinityEnabled')]",
-                "httpsOnly": "[parameters('httpsOnly')]",
-                "hostingEnvironmentProfile": "[if(not(empty(parameters('appServiceEnvironmentResourceId'))), createObject('id', parameters('appServiceEnvironmentResourceId')), null())]",
-                "storageAccountRequired": "[parameters('storageAccountRequired')]",
-                "keyVaultReferenceIdentity": "[parameters('keyVaultAccessIdentityResourceId')]",
-                "virtualNetworkSubnetId": "[parameters('virtualNetworkSubnetId')]",
-                "siteConfig": "[parameters('siteConfig')]",
-                "functionAppConfig": "[parameters('functionAppConfig')]",
-                "clientCertEnabled": "[parameters('clientCertEnabled')]",
-                "clientCertExclusionPaths": "[parameters('clientCertExclusionPaths')]",
-                "clientCertMode": "[parameters('clientCertMode')]",
-                "cloningInfo": "[parameters('cloningInfo')]",
-                "containerSize": "[parameters('containerSize')]",
-                "dailyMemoryTimeQuota": "[parameters('dailyMemoryTimeQuota')]",
-                "enabled": "[parameters('enabled')]",
-                "hostNameSslStates": "[parameters('hostNameSslStates')]",
-                "hyperV": "[parameters('hyperV')]",
-                "redundancyMode": "[parameters('redundancyMode')]",
-                "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(not(empty(parameters('privateEndpoints'))), 'Disabled', 'Enabled'))]",
-                "vnetContentShareEnabled": "[parameters('vnetContentShareEnabled')]",
-                "vnetImagePullEnabled": "[parameters('vnetImagePullEnabled')]",
-                "vnetRouteAllEnabled": "[parameters('vnetRouteAllEnabled')]",
-                "scmSiteAlsoStopped": "[parameters('scmSiteAlsoStopped')]",
-                "endToEndEncryptionEnabled": "[parameters('e2eEncryptionEnabled')]"
-              }
-            },
-            "app_lock": {
-              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-              "type": "Microsoft.Authorization/locks",
-              "apiVersion": "2020-05-01",
-              "scope": "[format('Microsoft.Web/sites/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-              "properties": {
-                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-              },
-              "dependsOn": [
-                "app"
-              ]
-            },
-            "app_diagnosticSettings": {
-              "copy": {
-                "name": "app_diagnosticSettings",
-                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-              },
-              "type": "Microsoft.Insights/diagnosticSettings",
-              "apiVersion": "2021-05-01-preview",
-              "scope": "[format('Microsoft.Web/sites/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-              "properties": {
-                "copy": [
-                  {
-                    "name": "metrics",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                    "input": {
-                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                      "timeGrain": null
-                    }
-                  },
-                  {
-                    "name": "logs",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                    "input": {
-                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                    }
-                  }
-                ],
-                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-              },
-              "dependsOn": [
-                "app"
-              ]
-            },
-            "app_roleAssignments": {
-              "copy": {
-                "name": "app_roleAssignments",
-                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-              },
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[format('Microsoft.Web/sites/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Web/sites', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-              "properties": {
-                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-              },
-              "dependsOn": [
-                "app"
-              ]
-            },
-            "app_appsettings": {
-              "condition": "[or(or(not(empty(parameters('appSettingsKeyValuePairs'))), not(empty(parameters('appInsightResourceId')))), not(empty(parameters('storageAccountResourceId'))))]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-Site-Config-AppSettings', uniqueString(deployment().name, parameters('location')))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "appName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "kind": {
-                    "value": "[parameters('kind')]"
-                  },
-                  "storageAccountResourceId": {
-                    "value": "[parameters('storageAccountResourceId')]"
-                  },
-                  "storageAccountUseIdentityAuthentication": {
-                    "value": "[parameters('storageAccountUseIdentityAuthentication')]"
-                  },
-                  "appInsightResourceId": {
-                    "value": "[parameters('appInsightResourceId')]"
-                  },
-                  "appSettingsKeyValuePairs": {
-                    "value": "[parameters('appSettingsKeyValuePairs')]"
-                  },
-                  "currentAppSettings": "[if(not(empty(resourceId('Microsoft.Web/sites', parameters('name')))), createObject('value', list(format('{0}/config/appsettings', resourceId('Microsoft.Web/sites', parameters('name'))), '2023-12-01').properties), createObject('value', createObject()))]"
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.33.93.31351",
-                      "templateHash": "12262977018813780856"
-                    },
-                    "name": "Site App Settings",
-                    "description": "This module deploys a Site App Setting."
-                  },
-                  "parameters": {
-                    "appName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "kind": {
-                      "type": "string",
-                      "allowedValues": [
-                        "functionapp",
-                        "functionapp,linux",
-                        "functionapp,workflowapp",
-                        "functionapp,workflowapp,linux",
-                        "functionapp,linux,container",
-                        "functionapp,linux,container,azurecontainerapps",
-                        "app,linux",
-                        "app",
-                        "linux,api",
-                        "api",
-                        "app,linux,container",
-                        "app,container,windows"
-                      ],
-                      "metadata": {
-                        "description": "Required. Type of site to deploy."
-                      }
-                    },
-                    "storageAccountResourceId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
-                      }
-                    },
-                    "storageAccountUseIdentityAuthentication": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
-                      }
-                    },
-                    "appInsightResourceId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Resource ID of the app insight to leverage for this resource."
-                      }
-                    },
-                    "appSettingsKeyValuePairs": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The app settings key-value pairs except for AzureWebJobsStorage, AzureWebJobsDashboard, APPINSIGHTS_INSTRUMENTATIONKEY and APPLICATIONINSIGHTS_CONNECTION_STRING."
-                      }
-                    },
-                    "currentAppSettings": {
-                      "type": "object",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. The current app settings."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "app": {
-                      "existing": true,
-                      "type": "Microsoft.Web/sites",
-                      "apiVersion": "2023-12-01",
-                      "name": "[parameters('appName')]"
-                    },
-                    "appInsight": {
-                      "condition": "[not(empty(parameters('appInsightResourceId')))]",
-                      "existing": true,
-                      "type": "Microsoft.Insights/components",
-                      "apiVersion": "2020-02-02",
-                      "subscriptionId": "[split(parameters('appInsightResourceId'), '/')[2]]",
-                      "resourceGroup": "[split(parameters('appInsightResourceId'), '/')[4]]",
-                      "name": "[last(split(parameters('appInsightResourceId'), '/'))]"
-                    },
-                    "storageAccount": {
-                      "condition": "[not(empty(parameters('storageAccountResourceId')))]",
-                      "existing": true,
-                      "type": "Microsoft.Storage/storageAccounts",
-                      "apiVersion": "2023-05-01",
-                      "subscriptionId": "[split(parameters('storageAccountResourceId'), '/')[2]]",
-                      "resourceGroup": "[split(parameters('storageAccountResourceId'), '/')[4]]",
-                      "name": "[last(split(parameters('storageAccountResourceId'), '/'))]"
-                    },
-                    "appSettings": {
-                      "type": "Microsoft.Web/sites/config",
-                      "apiVersion": "2024-04-01",
-                      "name": "[format('{0}/{1}', parameters('appName'), 'appsettings')]",
-                      "kind": "[parameters('kind')]",
-                      "properties": "[union(coalesce(parameters('currentAppSettings'), createObject()), coalesce(parameters('appSettingsKeyValuePairs'), createObject()), if(and(not(empty(parameters('storageAccountResourceId'))), not(parameters('storageAccountUseIdentityAuthentication'))), createObject('AzureWebJobsStorage', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', last(split(parameters('storageAccountResourceId'), '/')), listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('storageAccountResourceId'), '/')[2], split(parameters('storageAccountResourceId'), '/')[4]), 'Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), '2023-05-01').keys[0].value, environment().suffixes.storage)), if(and(not(empty(parameters('storageAccountResourceId'))), parameters('storageAccountUseIdentityAuthentication')), union(createObject('AzureWebJobsStorage__accountName', last(split(parameters('storageAccountResourceId'), '/'))), createObject('AzureWebJobsStorage__blobServiceUri', reference('storageAccount').primaryEndpoints.blob), createObject('AzureWebJobsStorage__queueServiceUri', reference('storageAccount').primaryEndpoints.queue), createObject('AzureWebJobsStorage__tableServiceUri', reference('storageAccount').primaryEndpoints.table)), createObject())), if(not(empty(parameters('appInsightResourceId'))), createObject('APPLICATIONINSIGHTS_CONNECTION_STRING', reference('appInsight').ConnectionString), createObject()))]",
-                      "dependsOn": [
-                        "appInsight",
-                        "storageAccount"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the site config."
-                      },
-                      "value": "appsettings"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the site config."
-                      },
-                      "value": "[resourceId('Microsoft.Web/sites/config', parameters('appName'), 'appsettings')]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group the site config was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "app"
-              ]
-            },
-            "app_authsettingsv2": {
-              "condition": "[not(empty(parameters('authSettingV2Configuration')))]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-Site-Config-AuthSettingsV2', uniqueString(deployment().name, parameters('location')))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "appName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "kind": {
-                    "value": "[parameters('kind')]"
-                  },
-                  "authSettingV2Configuration": {
-                    "value": "[coalesce(parameters('authSettingV2Configuration'), createObject())]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.33.93.31351",
-                      "templateHash": "1129994114817101549"
-                    },
-                    "name": "Site Auth Settings V2 Config",
-                    "description": "This module deploys a Site Auth Settings V2 Configuration."
-                  },
-                  "parameters": {
-                    "appName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "kind": {
-                      "type": "string",
-                      "allowedValues": [
-                        "functionapp",
-                        "functionapp,linux",
-                        "functionapp,workflowapp",
-                        "functionapp,workflowapp,linux",
-                        "functionapp,linux,container",
-                        "functionapp,linux,container,azurecontainerapps",
-                        "app,linux",
-                        "app",
-                        "linux,api",
-                        "api",
-                        "app,linux,container",
-                        "app,container,windows"
-                      ],
-                      "metadata": {
-                        "description": "Required. Type of site to deploy."
-                      }
-                    },
-                    "authSettingV2Configuration": {
-                      "type": "object",
-                      "metadata": {
-                        "description": "Required. The auth settings V2 configuration."
-                      }
-                    }
-                  },
-                  "resources": [
-                    {
-                      "type": "Microsoft.Web/sites/config",
-                      "apiVersion": "2024-04-01",
-                      "name": "[format('{0}/{1}', parameters('appName'), 'authsettingsV2')]",
-                      "kind": "[parameters('kind')]",
-                      "properties": "[parameters('authSettingV2Configuration')]"
-                    }
-                  ],
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the site config."
-                      },
-                      "value": "authsettingsV2"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the site config."
-                      },
-                      "value": "[resourceId('Microsoft.Web/sites/config', parameters('appName'), 'authsettingsV2')]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group the site config was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "app"
-              ]
-            },
-            "app_logssettings": {
-              "condition": "[not(empty(coalesce(parameters('logsConfiguration'), createObject())))]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-Site-Config-Logs', uniqueString(deployment().name, parameters('location')))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "appName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "logsConfiguration": {
-                    "value": "[parameters('logsConfiguration')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.33.93.31351",
-                      "templateHash": "17967336872376441757"
-                    },
-                    "name": "Site logs Config",
-                    "description": "This module deploys a Site logs Configuration."
-                  },
-                  "parameters": {
-                    "appName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the parent site resource."
-                      }
-                    },
-                    "logsConfiguration": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The logs settings configuration."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "app": {
-                      "existing": true,
-                      "type": "Microsoft.Web/sites",
-                      "apiVersion": "2024-04-01",
-                      "name": "[parameters('appName')]"
-                    },
-                    "webSettings": {
-                      "type": "Microsoft.Web/sites/config",
-                      "apiVersion": "2024-04-01",
-                      "name": "[format('{0}/{1}', parameters('appName'), 'logs')]",
-                      "kind": "string",
-                      "properties": "[parameters('logsConfiguration')]"
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the site config."
-                      },
-                      "value": "logs"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the site config."
-                      },
-                      "value": "[resourceId('Microsoft.Web/sites/config', parameters('appName'), 'logs')]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group the site config was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "app",
-                "app_appsettings"
-              ]
-            },
-            "app_websettings": {
-              "condition": "[not(empty(coalesce(parameters('webConfiguration'), createObject())))]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-Site-Config-Web', uniqueString(deployment().name, parameters('location')))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "appName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "webConfiguration": {
-                    "value": "[parameters('webConfiguration')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.33.93.31351",
-                      "templateHash": "15058680643544097487"
-                    },
-                    "name": "Site Web Config",
-                    "description": "This module deploys web settings configuration available under sites/config name: web."
-                  },
-                  "parameters": {
-                    "appName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the parent site resource."
-                      }
-                    },
-                    "webConfiguration": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The Site Config, Web settings to deploy."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "app": {
-                      "existing": true,
-                      "type": "Microsoft.Web/sites",
-                      "apiVersion": "2024-04-01",
-                      "name": "[parameters('appName')]"
-                    },
-                    "webSettings": {
-                      "type": "Microsoft.Web/sites/config",
-                      "apiVersion": "2024-04-01",
-                      "name": "[format('{0}/{1}', parameters('appName'), 'web')]",
-                      "kind": "string",
-                      "properties": "[parameters('webConfiguration')]"
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the site config."
-                      },
-                      "value": "web"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the site config."
-                      },
-                      "value": "[resourceId('Microsoft.Web/sites/config', parameters('appName'), 'web')]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group the site config was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "app"
-              ]
-            },
-            "extension_msdeploy": {
-              "condition": "[not(empty(parameters('msDeployConfiguration')))]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-Site-Extension-MSDeploy', uniqueString(deployment().name, parameters('location')))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "appName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "msDeployConfiguration": {
-                    "value": "[coalesce(parameters('msDeployConfiguration'), createObject())]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.33.93.31351",
-                      "templateHash": "14895622660217616811"
-                    },
-                    "name": "Site Deployment Extension ",
-                    "description": "This module deploys a Site extension for MSDeploy."
-                  },
-                  "parameters": {
-                    "appName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the parent site resource."
-                      }
-                    },
-                    "msDeployConfiguration": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Sets the MSDeployment Properties."
-                      }
-                    }
-                  },
-                  "resources": {
-                    "app": {
-                      "existing": true,
-                      "type": "Microsoft.Web/sites",
-                      "apiVersion": "2024-04-01",
-                      "name": "[parameters('appName')]"
-                    },
-                    "msdeploy": {
-                      "type": "Microsoft.Web/sites/extensions",
-                      "apiVersion": "2024-04-01",
-                      "name": "[format('{0}/{1}', parameters('appName'), 'MSDeploy')]",
-                      "kind": "MSDeploy",
-                      "properties": "[parameters('msDeployConfiguration')]"
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the MSDeploy Package."
-                      },
-                      "value": "MSDeploy"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the Site Extension."
-                      },
-                      "value": "[resourceId('Microsoft.Web/sites/extensions', parameters('appName'), 'MSDeploy')]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group the site config was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "app"
-              ]
-            },
-            "app_slots": {
-              "copy": {
-                "name": "app_slots",
-                "count": "[length(coalesce(parameters('slots'), createArray()))]",
-                "mode": "serial",
-                "batchSize": 1
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-Slot-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('slots'), createArray())[copyIndex()].name)]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[coalesce(parameters('slots'), createArray())[copyIndex()].name]"
-                  },
-                  "appName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "kind": {
-                    "value": "[parameters('kind')]"
-                  },
-                  "serverFarmResourceId": {
-                    "value": "[parameters('serverFarmResourceId')]"
-                  },
-                  "httpsOnly": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'httpsOnly'), parameters('httpsOnly'))]"
-                  },
-                  "appServiceEnvironmentResourceId": {
-                    "value": "[parameters('appServiceEnvironmentResourceId')]"
-                  },
-                  "clientAffinityEnabled": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientAffinityEnabled'), parameters('clientAffinityEnabled'))]"
-                  },
-                  "managedIdentities": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'managedIdentities'), parameters('managedIdentities'))]"
-                  },
-                  "keyVaultAccessIdentityResourceId": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'keyVaultAccessIdentityResourceId'), parameters('keyVaultAccessIdentityResourceId'))]"
-                  },
-                  "storageAccountRequired": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'storageAccountRequired'), parameters('storageAccountRequired'))]"
-                  },
-                  "virtualNetworkSubnetId": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'virtualNetworkSubnetId'), parameters('virtualNetworkSubnetId'))]"
-                  },
-                  "siteConfig": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'siteConfig'), parameters('siteConfig'))]"
-                  },
-                  "functionAppConfig": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'functionAppConfig'), parameters('functionAppConfig'))]"
-                  },
-                  "storageAccountResourceId": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'storageAccountResourceId'), parameters('storageAccountResourceId'))]"
-                  },
-                  "storageAccountUseIdentityAuthentication": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'storageAccountUseIdentityAuthentication'), parameters('storageAccountUseIdentityAuthentication'))]"
-                  },
-                  "appInsightResourceId": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'appInsightResourceId'), parameters('appInsightResourceId'))]"
-                  },
-                  "authSettingV2Configuration": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'authSettingV2Configuration'), parameters('authSettingV2Configuration'))]"
-                  },
-                  "msDeployConfiguration": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'msDeployConfiguration'), parameters('msDeployConfiguration'))]"
-                  },
-                  "diagnosticSettings": {
-                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'diagnosticSettings')]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'roleAssignments')]"
-                  },
-                  "appSettingsKeyValuePairs": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'appSettingsKeyValuePairs'), parameters('appSettingsKeyValuePairs'))]"
-                  },
-                  "basicPublishingCredentialsPolicies": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'basicPublishingCredentialsPolicies'), parameters('basicPublishingCredentialsPolicies'))]"
-                  },
-                  "lock": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
-                  },
-                  "privateEndpoints": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'privateEndpoints'), createArray())]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                  },
-                  "clientCertEnabled": {
-                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientCertEnabled')]"
-                  },
-                  "clientCertExclusionPaths": {
-                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientCertExclusionPaths')]"
-                  },
-                  "clientCertMode": {
-                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientCertMode')]"
-                  },
-                  "cloningInfo": {
-                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'cloningInfo')]"
-                  },
-                  "containerSize": {
-                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'containerSize')]"
-                  },
-                  "customDomainVerificationId": {
-                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'customDomainVerificationId')]"
-                  },
-                  "dailyMemoryTimeQuota": {
-                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'dailyMemoryTimeQuota')]"
-                  },
-                  "enabled": {
-                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'enabled')]"
-                  },
-                  "hostNameSslStates": {
-                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hostNameSslStates')]"
-                  },
-                  "hyperV": {
-                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hyperV')]"
-                  },
-                  "publicNetworkAccess": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'publicNetworkAccess'), if(or(not(empty(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'privateEndpoints'))), not(empty(parameters('privateEndpoints')))), 'Disabled', 'Enabled'))]"
-                  },
-                  "redundancyMode": {
-                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'redundancyMode')]"
-                  },
-                  "vnetContentShareEnabled": {
-                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'vnetContentShareEnabled')]"
-                  },
-                  "vnetImagePullEnabled": {
-                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'vnetImagePullEnabled')]"
-                  },
-                  "vnetRouteAllEnabled": {
-                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'vnetRouteAllEnabled')]"
-                  },
-                  "hybridConnectionRelays": {
-                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hybridConnectionRelays')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.33.93.31351",
-                      "templateHash": "4067755327331248181"
-                    },
-                    "name": "Web/Function App Deployment Slots",
-                    "description": "This module deploys a Web or Function App Deployment Slot."
-                  },
-                  "definitions": {
-                    "privateEndpointOutputType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "The name of the private endpoint."
-                          }
-                        },
-                        "resourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "The resource ID of the private endpoint."
-                          }
-                        },
-                        "groupId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "The group Id for the private endpoint Group."
-                          }
-                        },
-                        "customDnsConfigs": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "fqdn": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "FQDN that resolves to private endpoint IP address."
-                                }
-                              },
-                              "ipAddresses": {
-                                "type": "array",
-                                "items": {
-                                  "type": "string"
-                                },
-                                "metadata": {
-                                  "description": "A list of private IP addresses of the private endpoint."
-                                }
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "The custom DNS configurations of the private endpoint."
-                          }
-                        },
-                        "networkInterfaceResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "The IDs of the network interfaces associated with the private endpoint."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true
-                      }
-                    },
-                    "_1.privateEndpointCustomDnsConfigType": {
-                      "type": "object",
-                      "properties": {
-                        "fqdn": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. FQDN that resolves to private endpoint IP address."
-                          }
-                        },
-                        "ipAddresses": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "Required. A list of private IP addresses of the private endpoint."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "_1.privateEndpointIpConfigurationType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the resource that is unique within a resource group."
-                          }
-                        },
-                        "properties": {
-                          "type": "object",
-                          "properties": {
-                            "groupId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                              }
-                            },
-                            "memberName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
-                              }
-                            },
-                            "privateIPAddress": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. Properties of private endpoint IP configurations."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "_1.privateEndpointPrivateDnsZoneGroupType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the Private DNS Zone Group."
-                          }
-                        },
-                        "privateDnsZoneGroupConfigs": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "name": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. The name of the private DNS Zone Group config."
-                                }
-                              },
-                              "privateDnsZoneResourceId": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. The resource id of the private DNS zone."
-                                }
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "diagnosticSettingFullType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the diagnostic setting."
-                          }
-                        },
-                        "logCategoriesAndGroups": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                }
-                              },
-                              "categoryGroup": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                }
-                              },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                          }
-                        },
-                        "metricCategories": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                }
-                              },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                          }
-                        },
-                        "logAnalyticsDestinationType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "AzureDiagnostics",
-                            "Dedicated"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                          }
-                        },
-                        "workspaceResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "storageAccountResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "eventHubAuthorizationRuleResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                          }
-                        },
-                        "eventHubName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "marketplacePartnerResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "managedIdentityAllType": {
-                      "type": "object",
-                      "properties": {
-                        "systemAssigned": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enables system assigned managed identity on the resource."
-                          }
-                        },
-                        "userAssignedResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "privateEndpointSingleServiceType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the Private Endpoint."
-                          }
-                        },
-                        "location": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The location to deploy the Private Endpoint to."
-                          }
-                        },
-                        "privateLinkServiceConnectionName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the private link connection to create."
-                          }
-                        },
-                        "service": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
-                          }
-                        },
-                        "subnetResourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                          }
-                        },
-                        "resourceGroupResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
-                          }
-                        },
-                        "privateDnsZoneGroup": {
-                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
-                          }
-                        },
-                        "isManualConnection": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. If Manual Private Link Connection is required."
-                          }
-                        },
-                        "manualConnectionRequestMessage": {
-                          "type": "string",
-                          "nullable": true,
-                          "maxLength": 140,
-                          "metadata": {
-                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
-                          }
-                        },
-                        "customDnsConfigs": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Custom DNS configurations."
-                          }
-                        },
-                        "ipConfigurations": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
-                          }
-                        },
-                        "applicationSecurityGroupResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
-                          }
-                        },
-                        "customNetworkInterfaceName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
-                          }
-                        },
-                        "lock": {
-                          "$ref": "#/definitions/lockType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        },
-                        "roleAssignments": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/roleAssignmentType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Array of role assignments to create."
-                          }
-                        },
-                        "tags": {
-                          "type": "object",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
-                          }
-                        },
-                        "enableTelemetry": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enable/Disable usage telemetry for module."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the slot."
-                      }
-                    },
-                    "appName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all Resources."
-                      }
-                    },
-                    "kind": {
-                      "type": "string",
-                      "allowedValues": [
-                        "functionapp",
-                        "functionapp,linux",
-                        "functionapp,workflowapp",
-                        "functionapp,workflowapp,linux",
-                        "functionapp,linux,container",
-                        "functionapp,linux,container,azurecontainerapps",
-                        "app,linux",
-                        "app",
-                        "linux,api",
-                        "api",
-                        "app,linux,container",
-                        "app,container,windows"
-                      ],
-                      "metadata": {
-                        "description": "Required. Type of site to deploy."
-                      }
-                    },
-                    "serverFarmResourceId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The resource ID of the app service plan to use for the slot."
-                      }
-                    },
-                    "httpsOnly": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Configures a slot to accept only HTTPS requests. Issues redirect for HTTP requests."
-                      }
-                    },
-                    "clientAffinityEnabled": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. If client affinity is enabled."
-                      }
-                    },
-                    "appServiceEnvironmentResourceId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The resource ID of the app service environment to use for this resource."
-                      }
-                    },
-                    "managedIdentities": {
-                      "$ref": "#/definitions/managedIdentityAllType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The managed identity definition for this resource."
-                      }
-                    },
-                    "keyVaultAccessIdentityResourceId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The resource ID of the assigned identity to be used to access a key vault with."
-                      }
-                    },
-                    "storageAccountRequired": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Checks if Customer provided storage account is required."
-                      }
-                    },
-                    "virtualNetworkSubnetId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Azure Resource Manager ID of the Virtual network and subnet to be joined by Regional VNET Integration. This must be of the form /subscriptions/{subscriptionName}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}."
-                      }
-                    },
-                    "siteConfig": {
-                      "type": "object",
-                      "defaultValue": {
-                        "alwaysOn": true
-                      },
-                      "metadata": {
-                        "description": "Optional. The site config object."
-                      }
-                    },
-                    "functionAppConfig": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The Function App config object."
-                      }
-                    },
-                    "storageAccountResourceId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
-                      }
-                    },
-                    "storageAccountUseIdentityAuthentication": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
-                      }
-                    },
-                    "appInsightResourceId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Resource ID of the app insight to leverage for this resource."
-                      }
-                    },
-                    "appSettingsKeyValuePairs": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The app settings-value pairs except for AzureWebJobsStorage, AzureWebJobsDashboard, APPINSIGHTS_INSTRUMENTATIONKEY and APPLICATIONINSIGHTS_CONNECTION_STRING."
-                      }
-                    },
-                    "authSettingV2Configuration": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The auth settings V2 configuration."
-                      }
-                    },
-                    "msDeployConfiguration": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The extension MSDeployment configuration."
-                      }
-                    },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The lock settings of the service."
-                      }
-                    },
-                    "privateEndpoints": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/privateEndpointSingleServiceType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Configuration details for private endpoints."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the resource."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    },
-                    "diagnosticSettings": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/diagnosticSettingFullType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The diagnostic settings of the service."
-                      }
-                    },
-                    "clientCertEnabled": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. To enable client certificate authentication (TLS mutual authentication)."
-                      }
-                    },
-                    "clientCertExclusionPaths": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Client certificate authentication comma-separated exclusion paths."
-                      }
-                    },
-                    "clientCertMode": {
-                      "type": "string",
-                      "defaultValue": "Optional",
-                      "allowedValues": [
-                        "Optional",
-                        "OptionalInteractiveUser",
-                        "Required"
-                      ],
-                      "metadata": {
-                        "description": "Optional. This composes with ClientCertEnabled setting.</p>- ClientCertEnabled: false means ClientCert is ignored.</p>- ClientCertEnabled: true and ClientCertMode: Required means ClientCert is required.</p>- ClientCertEnabled: true and ClientCertMode: Optional means ClientCert is optional or accepted."
-                      }
-                    },
-                    "cloningInfo": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. If specified during app creation, the app is cloned from a source app."
-                      }
-                    },
-                    "containerSize": {
-                      "type": "int",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Size of the function container."
-                      }
-                    },
-                    "customDomainVerificationId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Unique identifier that verifies the custom domains assigned to the app. Customer will add this ID to a txt record for verification."
-                      }
-                    },
-                    "dailyMemoryTimeQuota": {
-                      "type": "int",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Maximum allowed daily memory-time quota (applicable on dynamic apps only)."
-                      }
-                    },
-                    "enabled": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Setting this value to false disables the app (takes the app offline)."
-                      }
-                    },
-                    "hostNameSslStates": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Hostname SSL states are used to manage the SSL bindings for app's hostnames."
-                      }
-                    },
-                    "hyperV": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Hyper-V sandbox."
-                      }
-                    },
-                    "publicNetworkAccess": {
-                      "type": "string",
-                      "nullable": true,
-                      "allowedValues": [
-                        "Enabled",
-                        "Disabled"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Allow or block all public traffic."
-                      }
-                    },
-                    "redundancyMode": {
-                      "type": "string",
-                      "defaultValue": "None",
-                      "allowedValues": [
-                        "ActiveActive",
-                        "Failover",
-                        "GeoRedundant",
-                        "Manual",
-                        "None"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Site redundancy mode."
-                      }
-                    },
-                    "basicPublishingCredentialsPolicies": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The site publishing credential policy names which are associated with the site slot."
-                      }
-                    },
-                    "vnetContentShareEnabled": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. To enable accessing content over virtual network."
-                      }
-                    },
-                    "vnetImagePullEnabled": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. To enable pulling image over Virtual Network."
-                      }
-                    },
-                    "vnetRouteAllEnabled": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Virtual Network Route All enabled. This causes all outbound traffic to have Virtual Network Security Groups and User Defined Routes applied."
-                      }
-                    },
-                    "hybridConnectionRelays": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Names of hybrid connection relays to connect app with."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "enableReferencedModulesTelemetry": false,
-                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
-                    "builtInRoleNames": {
-                      "App Compliance Automation Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f37683f-2463-46b6-9ce7-9b788b988ba2')]",
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
-                      "Web Plan Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b')]",
-                      "Website Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'de139f84-1756-47ae-9be6-808fbbe84772')]"
-                    }
-                  },
-                  "resources": {
-                    "app": {
-                      "existing": true,
-                      "type": "Microsoft.Web/sites",
-                      "apiVersion": "2024-04-01",
-                      "name": "[parameters('appName')]"
-                    },
-                    "slot": {
-                      "type": "Microsoft.Web/sites/slots",
-                      "apiVersion": "2024-04-01",
-                      "name": "[format('{0}/{1}', parameters('appName'), parameters('name'))]",
-                      "location": "[parameters('location')]",
-                      "kind": "[parameters('kind')]",
-                      "tags": "[parameters('tags')]",
-                      "identity": "[variables('identity')]",
-                      "properties": {
-                        "serverFarmId": "[parameters('serverFarmResourceId')]",
-                        "clientAffinityEnabled": "[parameters('clientAffinityEnabled')]",
-                        "httpsOnly": "[parameters('httpsOnly')]",
-                        "hostingEnvironmentProfile": "[if(not(empty(parameters('appServiceEnvironmentResourceId'))), createObject('id', parameters('appServiceEnvironmentResourceId')), null())]",
-                        "storageAccountRequired": "[parameters('storageAccountRequired')]",
-                        "keyVaultReferenceIdentity": "[parameters('keyVaultAccessIdentityResourceId')]",
-                        "virtualNetworkSubnetId": "[parameters('virtualNetworkSubnetId')]",
-                        "siteConfig": "[parameters('siteConfig')]",
-                        "functionAppConfig": "[parameters('functionAppConfig')]",
-                        "clientCertEnabled": "[parameters('clientCertEnabled')]",
-                        "clientCertExclusionPaths": "[parameters('clientCertExclusionPaths')]",
-                        "clientCertMode": "[parameters('clientCertMode')]",
-                        "cloningInfo": "[parameters('cloningInfo')]",
-                        "containerSize": "[parameters('containerSize')]",
-                        "customDomainVerificationId": "[parameters('customDomainVerificationId')]",
-                        "dailyMemoryTimeQuota": "[parameters('dailyMemoryTimeQuota')]",
-                        "enabled": "[parameters('enabled')]",
-                        "hostNameSslStates": "[parameters('hostNameSslStates')]",
-                        "hyperV": "[parameters('hyperV')]",
-                        "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
-                        "redundancyMode": "[parameters('redundancyMode')]",
-                        "vnetContentShareEnabled": "[parameters('vnetContentShareEnabled')]",
-                        "vnetImagePullEnabled": "[parameters('vnetImagePullEnabled')]",
-                        "vnetRouteAllEnabled": "[parameters('vnetRouteAllEnabled')]"
-                      }
-                    },
-                    "slot_lock": {
-                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                      "type": "Microsoft.Authorization/locks",
-                      "apiVersion": "2020-05-01",
-                      "scope": "[format('Microsoft.Web/sites/{0}/slots/{1}', parameters('appName'), parameters('name'))]",
-                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                      "properties": {
-                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-                      },
-                      "dependsOn": [
-                        "slot"
-                      ]
-                    },
-                    "slot_diagnosticSettings": {
-                      "copy": {
-                        "name": "slot_diagnosticSettings",
-                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                      },
-                      "type": "Microsoft.Insights/diagnosticSettings",
-                      "apiVersion": "2021-05-01-preview",
-                      "scope": "[format('Microsoft.Web/sites/{0}/slots/{1}', parameters('appName'), parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-                      "properties": {
-                        "copy": [
-                          {
-                            "name": "metrics",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                            "input": {
-                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                              "timeGrain": null
-                            }
-                          },
-                          {
-                            "name": "logs",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                            "input": {
-                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                            }
-                          }
-                        ],
-                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                      },
-                      "dependsOn": [
-                        "slot"
-                      ]
-                    },
-                    "slot_roleAssignments": {
-                      "copy": {
-                        "name": "slot_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Web/sites/{0}/slots/{1}', parameters('appName'), parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "slot"
-                      ]
-                    },
-                    "slot_appsettings": {
-                      "condition": "[or(or(not(empty(parameters('appSettingsKeyValuePairs'))), not(empty(parameters('appInsightResourceId')))), not(empty(parameters('storageAccountResourceId'))))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-Slot-{1}-Config-AppSettings', uniqueString(deployment().name, parameters('location')), parameters('name'))]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "slotName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "appName": {
-                            "value": "[parameters('appName')]"
-                          },
-                          "kind": {
-                            "value": "[parameters('kind')]"
-                          },
-                          "storageAccountResourceId": {
-                            "value": "[parameters('storageAccountResourceId')]"
-                          },
-                          "storageAccountUseIdentityAuthentication": {
-                            "value": "[parameters('storageAccountUseIdentityAuthentication')]"
-                          },
-                          "appInsightResourceId": {
-                            "value": "[parameters('appInsightResourceId')]"
-                          },
-                          "appSettingsKeyValuePairs": {
-                            "value": "[parameters('appSettingsKeyValuePairs')]"
-                          },
-                          "currentAppSettings": "[if(not(empty(resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name')))), createObject('value', list(format('{0}/config/appsettings', resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))), '2023-12-01').properties), createObject('value', createObject()))]"
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.33.93.31351",
-                              "templateHash": "18192409627790392598"
-                            },
-                            "name": "Site Slot App Settings",
-                            "description": "This module deploys a Site Slot App Setting."
-                          },
-                          "parameters": {
-                            "slotName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Slot name to be configured."
-                              }
-                            },
-                            "appName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "kind": {
-                              "type": "string",
-                              "allowedValues": [
-                                "functionapp",
-                                "functionapp,linux",
-                                "functionapp,workflowapp",
-                                "functionapp,workflowapp,linux",
-                                "functionapp,linux,container",
-                                "functionapp,linux,container,azurecontainerapps",
-                                "app,linux",
-                                "app",
-                                "linux,api",
-                                "api",
-                                "app,linux,container",
-                                "app,container,windows"
-                              ],
-                              "metadata": {
-                                "description": "Required. Type of site to deploy."
-                              }
-                            },
-                            "storageAccountResourceId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
-                              }
-                            },
-                            "storageAccountUseIdentityAuthentication": {
-                              "type": "bool",
-                              "defaultValue": false,
-                              "metadata": {
-                                "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
-                              }
-                            },
-                            "appInsightResourceId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Resource ID of the app insight to leverage for this resource."
-                              }
-                            },
-                            "appSettingsKeyValuePairs": {
-                              "type": "object",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The app settings key-value pairs except for AzureWebJobsStorage, AzureWebJobsDashboard, APPINSIGHTS_INSTRUMENTATIONKEY and APPLICATIONINSIGHTS_CONNECTION_STRING."
-                              }
-                            },
-                            "currentAppSettings": {
-                              "type": "object",
-                              "defaultValue": {},
-                              "metadata": {
-                                "description": "Optional. The current app settings."
-                              }
-                            }
-                          },
-                          "resources": {
-                            "app::slot": {
-                              "existing": true,
-                              "type": "Microsoft.Web/sites/slots",
-                              "apiVersion": "2024-04-01",
-                              "name": "[format('{0}/{1}', parameters('appName'), parameters('slotName'))]"
-                            },
-                            "app": {
-                              "existing": true,
-                              "type": "Microsoft.Web/sites",
-                              "apiVersion": "2024-04-01",
-                              "name": "[parameters('appName')]"
-                            },
-                            "appInsight": {
-                              "condition": "[not(empty(parameters('appInsightResourceId')))]",
-                              "existing": true,
-                              "type": "Microsoft.Insights/components",
-                              "apiVersion": "2020-02-02",
-                              "subscriptionId": "[split(parameters('appInsightResourceId'), '/')[2]]",
-                              "resourceGroup": "[split(parameters('appInsightResourceId'), '/')[4]]",
-                              "name": "[last(split(parameters('appInsightResourceId'), '/'))]"
-                            },
-                            "storageAccount": {
-                              "condition": "[not(empty(parameters('storageAccountResourceId')))]",
-                              "existing": true,
-                              "type": "Microsoft.Storage/storageAccounts",
-                              "apiVersion": "2023-05-01",
-                              "subscriptionId": "[split(parameters('storageAccountResourceId'), '/')[2]]",
-                              "resourceGroup": "[split(parameters('storageAccountResourceId'), '/')[4]]",
-                              "name": "[last(split(parameters('storageAccountResourceId'), '/'))]"
-                            },
-                            "slotSettings": {
-                              "type": "Microsoft.Web/sites/slots/config",
-                              "apiVersion": "2024-04-01",
-                              "name": "[format('{0}/{1}/{2}', parameters('appName'), parameters('slotName'), 'appsettings')]",
-                              "kind": "[parameters('kind')]",
-                              "properties": "[union(coalesce(parameters('currentAppSettings'), createObject()), coalesce(parameters('appSettingsKeyValuePairs'), createObject()), if(and(not(empty(parameters('storageAccountResourceId'))), not(parameters('storageAccountUseIdentityAuthentication'))), createObject('AzureWebJobsStorage', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', last(split(parameters('storageAccountResourceId'), '/')), listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('storageAccountResourceId'), '/')[2], split(parameters('storageAccountResourceId'), '/')[4]), 'Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), '2023-05-01').keys[0].value, environment().suffixes.storage)), if(and(not(empty(parameters('storageAccountResourceId'))), parameters('storageAccountUseIdentityAuthentication')), union(createObject('AzureWebJobsStorage__accountName', last(split(parameters('storageAccountResourceId'), '/'))), createObject('AzureWebJobsStorage__blobServiceUri', reference('storageAccount').primaryEndpoints.blob)), createObject())), if(not(empty(parameters('appInsightResourceId'))), createObject('APPLICATIONINSIGHTS_CONNECTION_STRING', reference('appInsight').ConnectionString), createObject()))]",
-                              "dependsOn": [
-                                "appInsight",
-                                "storageAccount"
-                              ]
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the slot config."
-                              },
-                              "value": "appsettings"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the slot config."
-                              },
-                              "value": "[resourceId('Microsoft.Web/sites/slots/config', parameters('appName'), parameters('slotName'), 'appsettings')]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group the slot config was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "slot"
-                      ]
-                    },
-                    "slot_authsettingsv2": {
-                      "condition": "[not(empty(parameters('authSettingV2Configuration')))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-Slot-{1}-Config-AuthSettingsV2', uniqueString(deployment().name, parameters('location')), parameters('name'))]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "slotName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "appName": {
-                            "value": "[parameters('appName')]"
-                          },
-                          "kind": {
-                            "value": "[parameters('kind')]"
-                          },
-                          "authSettingV2Configuration": {
-                            "value": "[coalesce(parameters('authSettingV2Configuration'), createObject())]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.33.93.31351",
-                              "templateHash": "4602741618711602070"
-                            },
-                            "name": "Site Slot Auth Settings V2 Config",
-                            "description": "This module deploys a Site Auth Settings V2 Configuration."
-                          },
-                          "parameters": {
-                            "appName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "slotName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Slot name to be configured."
-                              }
-                            },
-                            "kind": {
-                              "type": "string",
-                              "allowedValues": [
-                                "functionapp",
-                                "functionapp,linux",
-                                "functionapp,workflowapp",
-                                "functionapp,workflowapp,linux",
-                                "functionapp,linux,container",
-                                "functionapp,linux,container,azurecontainerapps",
-                                "app,linux",
-                                "app",
-                                "linux,api",
-                                "api",
-                                "app,linux,container",
-                                "app,container,windows"
-                              ],
-                              "metadata": {
-                                "description": "Required. Type of site to deploy."
-                              }
-                            },
-                            "authSettingV2Configuration": {
-                              "type": "object",
-                              "metadata": {
-                                "description": "Required. The auth settings V2 configuration."
-                              }
-                            }
-                          },
-                          "resources": [
-                            {
-                              "type": "Microsoft.Web/sites/slots/config",
-                              "apiVersion": "2024-04-01",
-                              "name": "[format('{0}/{1}/{2}', parameters('appName'), parameters('slotName'), 'authsettingsV2')]",
-                              "kind": "[parameters('kind')]",
-                              "properties": "[parameters('authSettingV2Configuration')]"
-                            }
-                          ],
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the slot config."
-                              },
-                              "value": "authsettingsV2"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the slot config."
-                              },
-                              "value": "[resourceId('Microsoft.Web/sites/slots/config', parameters('appName'), parameters('slotName'), 'authsettingsV2')]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group the slot config was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "slot"
-                      ]
-                    },
-                    "slot_basicPublishingCredentialsPolicies": {
-                      "copy": {
-                        "name": "slot_basicPublishingCredentialsPolicies",
-                        "count": "[length(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-Slot-Publish-Cred-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "appName": {
-                            "value": "[parameters('appName')]"
-                          },
-                          "slotName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "name": {
-                            "value": "[coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()].name]"
-                          },
-                          "allow": {
-                            "value": "[tryGet(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()], 'allow')]"
-                          },
-                          "location": {
-                            "value": "[parameters('location')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.33.93.31351",
-                              "templateHash": "8803130402255189673"
-                            },
-                            "name": "Web Site Slot Basic Publishing Credentials Policies",
-                            "description": "This module deploys a Web Site Slot Basic Publishing Credentials Policy."
-                          },
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "allowedValues": [
-                                "scm",
-                                "ftp"
-                              ],
-                              "metadata": {
-                                "description": "Required. The name of the resource."
-                              }
-                            },
-                            "allow": {
-                              "type": "bool",
-                              "defaultValue": true,
-                              "metadata": {
-                                "description": "Optional. Set to true to enable or false to disable a publishing method."
-                              }
-                            },
-                            "appName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "slotName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent web site slot. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "location": {
-                              "type": "string",
-                              "defaultValue": "[resourceGroup().location]",
-                              "metadata": {
-                                "description": "Optional. Location for all Resources."
-                              }
-                            }
-                          },
-                          "resources": [
-                            {
-                              "type": "Microsoft.Web/sites/slots/basicPublishingCredentialsPolicies",
-                              "apiVersion": "2024-04-01",
-                              "name": "[format('{0}/{1}/{2}', parameters('appName'), parameters('slotName'), parameters('name'))]",
-                              "location": "[parameters('location')]",
-                              "properties": {
-                                "allow": "[parameters('allow')]"
-                              }
-                            }
-                          ],
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the basic publishing credential policy."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the basic publishing credential policy."
-                              },
-                              "value": "[resourceId('Microsoft.Web/sites/slots/basicPublishingCredentialsPolicies', parameters('appName'), parameters('slotName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the resource group the basic publishing credential policy was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
-                            },
-                            "location": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The location the resource was deployed into."
-                              },
-                              "value": "[reference(resourceId('Microsoft.Web/sites/slots/basicPublishingCredentialsPolicies', parameters('appName'), parameters('slotName'), parameters('name')), '2024-04-01', 'full').location]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "slot"
-                      ]
-                    },
-                    "slot_hybridConnectionRelays": {
-                      "copy": {
-                        "name": "slot_hybridConnectionRelays",
-                        "count": "[length(coalesce(parameters('hybridConnectionRelays'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-Slot-HybridConnectionRelay-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "hybridConnectionResourceId": {
-                            "value": "[coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()].resourceId]"
-                          },
-                          "appName": {
-                            "value": "[parameters('appName')]"
-                          },
-                          "slotName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "sendKeyName": {
-                            "value": "[tryGet(coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()], 'sendKeyName')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.33.93.31351",
-                              "templateHash": "16445776675656358479"
-                            },
-                            "name": "Web/Function Apps Slot Hybrid Connection Relay",
-                            "description": "This module deploys a Site Slot Hybrid Connection Namespace Relay."
-                          },
-                          "parameters": {
-                            "hybridConnectionResourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The resource ID of the relay namespace hybrid connection."
-                              }
-                            },
-                            "slotName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the site slot. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "appName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "sendKeyName": {
-                              "type": "string",
-                              "defaultValue": "defaultSender",
-                              "metadata": {
-                                "description": "Optional. Name of the authorization rule send key to use."
-                              }
-                            }
-                          },
-                          "resources": [
-                            {
-                              "type": "Microsoft.Web/sites/slots/hybridConnectionNamespaces/relays",
-                              "apiVersion": "2024-04-01",
-                              "name": "[format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
-                              "properties": {
-                                "serviceBusNamespace": "[split(parameters('hybridConnectionResourceId'), '/')[8]]",
-                                "serviceBusSuffix": "[split(substring(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2021-11-01').serviceBusEndpoint, indexOf(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2021-11-01').serviceBusEndpoint, '.servicebus')), ':')[0]]",
-                                "relayName": "[split(parameters('hybridConnectionResourceId'), '/')[10]]",
-                                "relayArmUri": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
-                                "hostname": "[split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2021-11-01').userMetadata)[0].value, ':')[0]]",
-                                "port": "[int(split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2021-11-01').userMetadata)[0].value, ':')[1])]",
-                                "sendKeyName": "[parameters('sendKeyName')]",
-                                "sendKeyValue": "[listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections/authorizationRules', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10], parameters('sendKeyName')), '2021-11-01').primaryKey]"
-                              }
-                            }
-                          ],
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the hybrid connection relay.."
-                              },
-                              "value": "[format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the hybrid connection relay."
-                              },
-                              "value": "[resourceId('Microsoft.Web/sites/slots/hybridConnectionNamespaces/relays', split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[0], split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[1], split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[2], split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[3])]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the resource group the resource was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "slot"
-                      ]
-                    },
-                    "slot_extensionMSdeploy": {
-                      "condition": "[not(empty(parameters('msDeployConfiguration')))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-Site-Extension-MSDeploy', uniqueString(deployment().name, parameters('location')))]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "appName": {
-                            "value": "[parameters('appName')]"
-                          },
-                          "msDeployConfiguration": {
-                            "value": "[coalesce(parameters('msDeployConfiguration'), createObject())]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.33.93.31351",
-                              "templateHash": "14895622660217616811"
-                            },
-                            "name": "Site Deployment Extension ",
-                            "description": "This module deploys a Site extension for MSDeploy."
-                          },
-                          "parameters": {
-                            "appName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The name of the parent site resource."
-                              }
-                            },
-                            "msDeployConfiguration": {
-                              "type": "object",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Sets the MSDeployment Properties."
-                              }
-                            }
-                          },
-                          "resources": {
-                            "app": {
-                              "existing": true,
-                              "type": "Microsoft.Web/sites",
-                              "apiVersion": "2024-04-01",
-                              "name": "[parameters('appName')]"
-                            },
-                            "msdeploy": {
-                              "type": "Microsoft.Web/sites/extensions",
-                              "apiVersion": "2024-04-01",
-                              "name": "[format('{0}/{1}', parameters('appName'), 'MSDeploy')]",
-                              "kind": "MSDeploy",
-                              "properties": "[parameters('msDeployConfiguration')]"
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the MSDeploy Package."
-                              },
-                              "value": "MSDeploy"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the Site Extension."
-                              },
-                              "value": "[resourceId('Microsoft.Web/sites/extensions', parameters('appName'), 'MSDeploy')]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group the site config was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "slot_privateEndpoints": {
-                      "copy": {
-                        "name": "slot_privateEndpoints",
-                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-slot-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
-                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('appName')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name'))), copyIndex()))]"
-                          },
-                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('appName')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name'))), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('appName')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name')))))))), createObject('value', null()))]",
-                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('appName')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name'))), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('appName')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name')))), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
-                          "subnetResourceId": {
-                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
-                          },
-                          "enableTelemetry": {
-                            "value": "[variables('enableReferencedModulesTelemetry')]"
-                          },
-                          "location": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
-                          },
-                          "lock": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
-                          },
-                          "privateDnsZoneGroup": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
-                          },
-                          "roleAssignments": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
-                          },
-                          "tags": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                          },
-                          "customDnsConfigs": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
-                          },
-                          "ipConfigurations": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
-                          },
-                          "applicationSecurityGroupResourceIds": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
-                          },
-                          "customNetworkInterfaceName": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.33.13.18514",
-                              "templateHash": "15954548978129725136"
-                            },
-                            "name": "Private Endpoints",
-                            "description": "This module deploys a Private Endpoint."
-                          },
-                          "definitions": {
-                            "privateDnsZoneGroupType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of the Private DNS Zone Group."
-                                  }
-                                },
-                                "privateDnsZoneGroupConfigs": {
-                                  "type": "array",
-                                  "items": {
-                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                                  },
-                                  "metadata": {
-                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            },
-                            "ipConfigurationType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The name of the resource that is unique within a resource group."
-                                  }
-                                },
-                                "properties": {
-                                  "type": "object",
-                                  "properties": {
-                                    "groupId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                                      }
-                                    },
-                                    "memberName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                                      }
-                                    },
-                                    "privateIPAddress": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                                      }
-                                    }
-                                  },
-                                  "metadata": {
-                                    "description": "Required. Properties of private endpoint IP configurations."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            },
-                            "privateLinkServiceConnectionType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The name of the private link service connection."
-                                  }
-                                },
-                                "properties": {
-                                  "type": "object",
-                                  "properties": {
-                                    "groupIds": {
-                                      "type": "array",
-                                      "items": {
-                                        "type": "string"
-                                      },
-                                      "metadata": {
-                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
-                                      }
-                                    },
-                                    "privateLinkServiceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The resource id of private link service."
-                                      }
-                                    },
-                                    "requestMessage": {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
-                                      }
-                                    }
-                                  },
-                                  "metadata": {
-                                    "description": "Required. Properties of private link service connection."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            },
-                            "customDnsConfigType": {
-                              "type": "object",
-                              "properties": {
-                                "fqdn": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
-                                  }
-                                },
-                                "ipAddresses": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "string"
-                                  },
-                                  "metadata": {
-                                    "description": "Required. A list of private IP addresses of the private endpoint."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            },
-                            "lockType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the name of lock."
-                                  }
-                                },
-                                "kind": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "CanNotDelete",
-                                    "None",
-                                    "ReadOnly"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the type of lock."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a lock.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                }
-                              }
-                            },
-                            "privateDnsZoneGroupConfigType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of the private DNS zone group config."
-                                  }
-                                },
-                                "privateDnsZoneResourceId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The resource id of the private DNS zone."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
-                                }
-                              }
-                            },
-                            "roleAssignmentType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                  }
-                                },
-                                "roleDefinitionIdOrName": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                  }
-                                },
-                                "principalId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                  }
-                                },
-                                "principalType": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "Device",
-                                    "ForeignGroup",
-                                    "Group",
-                                    "ServicePrincipal",
-                                    "User"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The principal type of the assigned principal ID."
-                                  }
-                                },
-                                "description": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The description of the role assignment."
-                                  }
-                                },
-                                "condition": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                  }
-                                },
-                                "conditionVersion": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "2.0"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Version of the condition."
-                                  }
-                                },
-                                "delegatedManagedIdentityResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a role assignment.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                }
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the private endpoint resource to create."
-                              }
-                            },
-                            "subnetResourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                              }
-                            },
-                            "applicationSecurityGroupResourceIds": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
-                              }
-                            },
-                            "customNetworkInterfaceName": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                              }
-                            },
-                            "ipConfigurations": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/ipConfigurationType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
-                              }
-                            },
-                            "privateDnsZoneGroup": {
-                              "$ref": "#/definitions/privateDnsZoneGroupType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
-                              }
-                            },
-                            "location": {
-                              "type": "string",
-                              "defaultValue": "[resourceGroup().location]",
-                              "metadata": {
-                                "description": "Optional. Location for all Resources."
-                              }
-                            },
-                            "lock": {
-                              "$ref": "#/definitions/lockType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The lock settings of the service."
-                              }
-                            },
-                            "roleAssignments": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/roleAssignmentType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Array of role assignments to create."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
-                              }
-                            },
-                            "customDnsConfigs": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/customDnsConfigType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Custom DNS configurations."
-                              }
-                            },
-                            "manualPrivateLinkServiceConnections": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/privateLinkServiceConnectionType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
-                              }
-                            },
-                            "privateLinkServiceConnections": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/privateLinkServiceConnectionType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
-                              }
-                            },
-                            "enableTelemetry": {
-                              "type": "bool",
-                              "defaultValue": true,
-                              "metadata": {
-                                "description": "Optional. Enable/Disable usage telemetry for module."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "copy": [
-                              {
-                                "name": "formattedRoleAssignments",
-                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                              }
-                            ],
-                            "builtInRoleNames": {
-                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
-                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
-                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
-                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
-                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
-                            }
-                          },
-                          "resources": {
-                            "avmTelemetry": {
-                              "condition": "[parameters('enableTelemetry')]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2024-03-01",
-                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.10.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                              "properties": {
-                                "mode": "Incremental",
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "contentVersion": "1.0.0.0",
-                                  "resources": [],
-                                  "outputs": {
-                                    "telemetry": {
-                                      "type": "String",
-                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                    }
-                                  }
-                                }
-                              }
-                            },
-                            "privateEndpoint": {
-                              "type": "Microsoft.Network/privateEndpoints",
-                              "apiVersion": "2023-11-01",
-                              "name": "[parameters('name')]",
-                              "location": "[parameters('location')]",
-                              "tags": "[parameters('tags')]",
-                              "properties": {
-                                "copy": [
-                                  {
-                                    "name": "applicationSecurityGroups",
-                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
-                                    "input": {
-                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
-                                    }
-                                  }
-                                ],
-                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
-                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
-                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
-                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
-                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
-                                "subnet": {
-                                  "id": "[parameters('subnetResourceId')]"
-                                }
-                              }
-                            },
-                            "privateEndpoint_lock": {
-                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                              "type": "Microsoft.Authorization/locks",
-                              "apiVersion": "2020-05-01",
-                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                              "properties": {
-                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-                              },
-                              "dependsOn": [
-                                "privateEndpoint"
-                              ]
-                            },
-                            "privateEndpoint_roleAssignments": {
-                              "copy": {
-                                "name": "privateEndpoint_roleAssignments",
-                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                              },
-                              "type": "Microsoft.Authorization/roleAssignments",
-                              "apiVersion": "2022-04-01",
-                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                              "properties": {
-                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                              },
-                              "dependsOn": [
-                                "privateEndpoint"
-                              ]
-                            },
-                            "privateEndpoint_privateDnsZoneGroup": {
-                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2022-09-01",
-                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "name": {
-                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
-                                  },
-                                  "privateEndpointName": {
-                                    "value": "[parameters('name')]"
-                                  },
-                                  "privateDnsZoneConfigs": {
-                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "languageVersion": "2.0",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.33.13.18514",
-                                      "templateHash": "5440815542537978381"
-                                    },
-                                    "name": "Private Endpoint Private DNS Zone Groups",
-                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
-                                  },
-                                  "definitions": {
-                                    "privateDnsZoneGroupConfigType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the private DNS zone group config."
-                                          }
-                                        },
-                                        "privateDnsZoneResourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The resource id of the private DNS zone."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true
-                                      }
-                                    }
-                                  },
-                                  "parameters": {
-                                    "privateEndpointName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
-                                      }
-                                    },
-                                    "privateDnsZoneConfigs": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                                      },
-                                      "minLength": 1,
-                                      "maxLength": 5,
-                                      "metadata": {
-                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
-                                      }
-                                    },
-                                    "name": {
-                                      "type": "string",
-                                      "defaultValue": "default",
-                                      "metadata": {
-                                        "description": "Optional. The name of the private DNS zone group."
-                                      }
-                                    }
-                                  },
-                                  "variables": {
-                                    "copy": [
-                                      {
-                                        "name": "privateDnsZoneConfigsVar",
-                                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
-                                        "input": {
-                                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
-                                          "properties": {
-                                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
-                                          }
-                                        }
-                                      }
-                                    ]
-                                  },
-                                  "resources": {
-                                    "privateEndpoint": {
-                                      "existing": true,
-                                      "type": "Microsoft.Network/privateEndpoints",
-                                      "apiVersion": "2023-11-01",
-                                      "name": "[parameters('privateEndpointName')]"
-                                    },
-                                    "privateDnsZoneGroup": {
-                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
-                                      "apiVersion": "2023-11-01",
-                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
-                                      "properties": {
-                                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
-                                      }
-                                    }
-                                  },
-                                  "outputs": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the private endpoint DNS zone group."
-                                      },
-                                      "value": "[parameters('name')]"
-                                    },
-                                    "resourceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource ID of the private endpoint DNS zone group."
-                                      },
-                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
-                                    },
-                                    "resourceGroupName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
-                                      },
-                                      "value": "[resourceGroup().name]"
-                                    }
-                                  }
-                                }
-                              },
-                              "dependsOn": [
-                                "privateEndpoint"
-                              ]
-                            }
-                          },
-                          "outputs": {
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group the private endpoint was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the private endpoint."
-                              },
-                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the private endpoint."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "location": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The location the resource was deployed into."
-                              },
-                              "value": "[reference('privateEndpoint', '2023-11-01', 'full').location]"
-                            },
-                            "customDnsConfigs": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/customDnsConfigType"
-                              },
-                              "metadata": {
-                                "description": "The custom DNS configurations of the private endpoint."
-                              },
-                              "value": "[reference('privateEndpoint').customDnsConfigs]"
-                            },
-                            "networkInterfaceResourceIds": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "metadata": {
-                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
-                              },
-                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
-                            },
-                            "groupId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "The group Id for the private endpoint Group."
-                              },
-                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "slot"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the slot."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the slot."
-                      },
-                      "value": "[resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group the slot was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "systemAssignedMIPrincipalId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "The principal ID of the system assigned identity."
-                      },
-                      "value": "[tryGet(tryGet(reference('slot', '2024-04-01', 'full'), 'identity'), 'principalId')]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('slot', '2024-04-01', 'full').location]"
-                    },
-                    "privateEndpoints": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/privateEndpointOutputType"
-                      },
-                      "metadata": {
-                        "description": "The private endpoints of the slot."
-                      },
-                      "copy": {
-                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
-                        "input": {
-                          "name": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
-                          "resourceId": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
-                          "groupId": "[tryGet(tryGet(reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
-                          "customDnsConfigs": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
-                          "networkInterfaceResourceIds": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
-                        }
-                      }
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "app"
-              ]
-            },
-            "app_basicPublishingCredentialsPolicies": {
-              "copy": {
-                "name": "app_basicPublishingCredentialsPolicies",
-                "count": "[length(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-Site-Publish-Cred-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "webAppName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()].name]"
-                  },
-                  "allow": {
-                    "value": "[tryGet(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()], 'allow')]"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.33.93.31351",
-                      "templateHash": "7001118912896436334"
-                    },
-                    "name": "Web Site Basic Publishing Credentials Policies",
-                    "description": "This module deploys a Web Site Basic Publishing Credentials Policy."
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "allowedValues": [
-                        "scm",
-                        "ftp"
-                      ],
-                      "metadata": {
-                        "description": "Required. The name of the resource."
-                      }
-                    },
-                    "allow": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Set to true to enable or false to disable a publishing method."
-                      }
-                    },
-                    "webAppName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all Resources."
-                      }
-                    }
-                  },
-                  "resources": [
-                    {
-                      "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies",
-                      "apiVersion": "2024-04-01",
-                      "name": "[format('{0}/{1}', parameters('webAppName'), parameters('name'))]",
-                      "location": "[parameters('location')]",
-                      "properties": {
-                        "allow": "[parameters('allow')]"
-                      }
-                    }
-                  ],
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the basic publishing credential policy."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the basic publishing credential policy."
-                      },
-                      "value": "[resourceId('Microsoft.Web/sites/basicPublishingCredentialsPolicies', parameters('webAppName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the resource group the basic publishing credential policy was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference(resourceId('Microsoft.Web/sites/basicPublishingCredentialsPolicies', parameters('webAppName'), parameters('name')), '2024-04-01', 'full').location]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "app"
-              ]
-            },
-            "app_hybridConnectionRelays": {
-              "copy": {
-                "name": "app_hybridConnectionRelays",
-                "count": "[length(coalesce(parameters('hybridConnectionRelays'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-HybridConnectionRelay-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "hybridConnectionResourceId": {
-                    "value": "[coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()].resourceId]"
-                  },
-                  "appName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "sendKeyName": {
-                    "value": "[tryGet(coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()], 'sendKeyName')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.33.93.31351",
-                      "templateHash": "13214417392638890300"
-                    },
-                    "name": "Web/Function Apps Hybrid Connection Relay",
-                    "description": "This module deploys a Site Hybrid Connection Namespace Relay."
-                  },
-                  "parameters": {
-                    "hybridConnectionResourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The resource ID of the relay namespace hybrid connection."
-                      }
-                    },
-                    "appName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "sendKeyName": {
-                      "type": "string",
-                      "defaultValue": "defaultSender",
-                      "metadata": {
-                        "description": "Optional. Name of the authorization rule send key to use."
-                      }
-                    }
-                  },
-                  "resources": [
-                    {
-                      "type": "Microsoft.Web/sites/hybridConnectionNamespaces/relays",
-                      "apiVersion": "2024-04-01",
-                      "name": "[format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
-                      "properties": {
-                        "serviceBusNamespace": "[split(parameters('hybridConnectionResourceId'), '/')[8]]",
-                        "serviceBusSuffix": "[split(substring(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2021-11-01').serviceBusEndpoint, indexOf(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2021-11-01').serviceBusEndpoint, '.servicebus')), ':')[0]]",
-                        "relayName": "[split(parameters('hybridConnectionResourceId'), '/')[10]]",
-                        "relayArmUri": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
-                        "hostname": "[split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2021-11-01').userMetadata)[0].value, ':')[0]]",
-                        "port": "[int(split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2021-11-01').userMetadata)[0].value, ':')[1])]",
-                        "sendKeyName": "[parameters('sendKeyName')]",
-                        "sendKeyValue": "[listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections/authorizationRules', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10], parameters('sendKeyName')), '2021-11-01').primaryKey]"
-                      }
-                    }
-                  ],
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the hybrid connection relay.."
-                      },
-                      "value": "[format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the hybrid connection relay."
-                      },
-                      "value": "[resourceId('Microsoft.Web/sites/hybridConnectionNamespaces/relays', split(format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[0], split(format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[1], split(format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[2])]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the resource group the resource was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "app"
-              ]
-            },
-            "app_privateEndpoints": {
-              "copy": {
-                "name": "app_privateEndpoints",
-                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-app-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
-              "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites'), copyIndex()))]"
-                  },
-                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites')))))), createObject('value', null()))]",
-                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
-                  "subnetResourceId": {
-                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
-                  },
-                  "enableTelemetry": {
-                    "value": "[variables('enableReferencedModulesTelemetry')]"
-                  },
-                  "location": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
-                  },
-                  "lock": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
-                  },
-                  "privateDnsZoneGroup": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
-                  },
-                  "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                  },
-                  "customDnsConfigs": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
-                  },
-                  "ipConfigurations": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
-                  },
-                  "applicationSecurityGroupResourceIds": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
-                  },
-                  "customNetworkInterfaceName": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.33.13.18514",
-                      "templateHash": "15954548978129725136"
-                    },
-                    "name": "Private Endpoints",
-                    "description": "This module deploys a Private Endpoint."
-                  },
-                  "definitions": {
-                    "privateDnsZoneGroupType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the Private DNS Zone Group."
-                          }
-                        },
-                        "privateDnsZoneGroupConfigs": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                          },
-                          "metadata": {
-                            "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true
-                      }
-                    },
-                    "ipConfigurationType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the resource that is unique within a resource group."
-                          }
-                        },
-                        "properties": {
-                          "type": "object",
-                          "properties": {
-                            "groupId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                              }
-                            },
-                            "memberName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                              }
-                            },
-                            "privateIPAddress": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. Properties of private endpoint IP configurations."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true
-                      }
-                    },
-                    "privateLinkServiceConnectionType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the private link service connection."
-                          }
-                        },
-                        "properties": {
-                          "type": "object",
-                          "properties": {
-                            "groupIds": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "metadata": {
-                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
-                              }
-                            },
-                            "privateLinkServiceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The resource id of private link service."
-                              }
-                            },
-                            "requestMessage": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. Properties of private link service connection."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true
-                      }
-                    },
-                    "customDnsConfigType": {
-                      "type": "object",
-                      "properties": {
-                        "fqdn": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. FQDN that resolves to private endpoint IP address."
-                          }
-                        },
-                        "ipAddresses": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "Required. A list of private IP addresses of the private endpoint."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true
-                      }
-                    },
-                    "lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "privateDnsZoneGroupConfigType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the private DNS zone group config."
-                          }
-                        },
-                        "privateDnsZoneResourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The resource id of the private DNS zone."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "private-dns-zone-group/main.bicep"
-                        }
-                      }
-                    },
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the private endpoint resource to create."
-                      }
-                    },
-                    "subnetResourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                      }
-                    },
-                    "applicationSecurityGroupResourceIds": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
-                      }
-                    },
-                    "customNetworkInterfaceName": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                      }
-                    },
-                    "ipConfigurations": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/ipConfigurationType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
-                      }
-                    },
-                    "privateDnsZoneGroup": {
-                      "$ref": "#/definitions/privateDnsZoneGroupType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The private DNS zone group to configure for the private endpoint."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all Resources."
-                      }
-                    },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The lock settings of the service."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
-                      }
-                    },
-                    "customDnsConfigs": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/customDnsConfigType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Custom DNS configurations."
-                      }
-                    },
-                    "manualPrivateLinkServiceConnections": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/privateLinkServiceConnectionType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
-                      }
-                    },
-                    "privateLinkServiceConnections": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/privateLinkServiceConnectionType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
-                      }
-                    },
-                    "enableTelemetry": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Enable/Disable usage telemetry for module."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
-                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
-                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
-                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
-                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
-                    }
-                  },
-                  "resources": {
-                    "avmTelemetry": {
-                      "condition": "[parameters('enableTelemetry')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2024-03-01",
-                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.10.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                      "properties": {
-                        "mode": "Incremental",
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "resources": [],
-                          "outputs": {
-                            "telemetry": {
-                              "type": "String",
-                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "privateEndpoint": {
-                      "type": "Microsoft.Network/privateEndpoints",
-                      "apiVersion": "2023-11-01",
-                      "name": "[parameters('name')]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "copy": [
-                          {
-                            "name": "applicationSecurityGroups",
-                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
-                            "input": {
-                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
-                            }
-                          }
-                        ],
-                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
-                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
-                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
-                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
-                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
-                        "subnet": {
-                          "id": "[parameters('subnetResourceId')]"
-                        }
-                      }
-                    },
-                    "privateEndpoint_lock": {
-                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                      "type": "Microsoft.Authorization/locks",
-                      "apiVersion": "2020-05-01",
-                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                      "properties": {
-                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-                      },
-                      "dependsOn": [
-                        "privateEndpoint"
-                      ]
-                    },
-                    "privateEndpoint_roleAssignments": {
-                      "copy": {
-                        "name": "privateEndpoint_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "privateEndpoint"
-                      ]
-                    },
-                    "privateEndpoint_privateDnsZoneGroup": {
-                      "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
-                          },
-                          "privateEndpointName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "privateDnsZoneConfigs": {
-                            "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.33.13.18514",
-                              "templateHash": "5440815542537978381"
-                            },
-                            "name": "Private Endpoint Private DNS Zone Groups",
-                            "description": "This module deploys a Private Endpoint Private DNS Zone Group."
-                          },
-                          "definitions": {
-                            "privateDnsZoneGroupConfigType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of the private DNS zone group config."
-                                  }
-                                },
-                                "privateDnsZoneResourceId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The resource id of the private DNS zone."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "privateEndpointName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "privateDnsZoneConfigs": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                              },
-                              "minLength": 1,
-                              "maxLength": 5,
-                              "metadata": {
-                                "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "defaultValue": "default",
-                              "metadata": {
-                                "description": "Optional. The name of the private DNS zone group."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "copy": [
-                              {
-                                "name": "privateDnsZoneConfigsVar",
-                                "count": "[length(parameters('privateDnsZoneConfigs'))]",
-                                "input": {
-                                  "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
-                                  "properties": {
-                                    "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
-                                  }
-                                }
-                              }
-                            ]
-                          },
-                          "resources": {
-                            "privateEndpoint": {
-                              "existing": true,
-                              "type": "Microsoft.Network/privateEndpoints",
-                              "apiVersion": "2023-11-01",
-                              "name": "[parameters('privateEndpointName')]"
-                            },
-                            "privateDnsZoneGroup": {
-                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
-                              "apiVersion": "2023-11-01",
-                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
-                              "properties": {
-                                "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the private endpoint DNS zone group."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the private endpoint DNS zone group."
-                              },
-                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group the private endpoint DNS zone group was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "privateEndpoint"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group the private endpoint was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the private endpoint."
-                      },
-                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the private endpoint."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('privateEndpoint', '2023-11-01', 'full').location]"
-                    },
-                    "customDnsConfigs": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/customDnsConfigType"
-                      },
-                      "metadata": {
-                        "description": "The custom DNS configurations of the private endpoint."
-                      },
-                      "value": "[reference('privateEndpoint').customDnsConfigs]"
-                    },
-                    "networkInterfaceResourceIds": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "metadata": {
-                        "description": "The resource IDs of the network interfaces associated with the private endpoint."
-                      },
-                      "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
-                    },
-                    "groupId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "The group Id for the private endpoint Group."
-                      },
-                      "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "app"
-              ]
-            }
-          },
-          "outputs": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the site."
-              },
-              "value": "[parameters('name')]"
-            },
-            "resourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource ID of the site."
-              },
-              "value": "[resourceId('Microsoft.Web/sites', parameters('name'))]"
-            },
-            "slots": {
-              "type": "array",
-              "metadata": {
-                "description": "The list of the slots."
-              },
-              "copy": {
-                "count": "[length(coalesce(parameters('slots'), createArray()))]",
-                "input": "[format('{0}-Slot-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('slots'), createArray())[copyIndex()].name)]"
-              }
-            },
-            "slotResourceIds": {
-              "type": "array",
-              "metadata": {
-                "description": "The list of the slot resource ids."
-              },
-              "copy": {
-                "count": "[length(coalesce(parameters('slots'), createArray()))]",
-                "input": "[reference(format('app_slots[{0}]', copyIndex())).outputs.resourceId.value]"
-              }
-            },
-            "resourceGroupName": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource group the site was deployed into."
-              },
-              "value": "[resourceGroup().name]"
-            },
-            "systemAssignedMIPrincipalId": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "The principal ID of the system assigned identity."
-              },
-              "value": "[tryGet(tryGet(reference('app', '2024-04-01', 'full'), 'identity'), 'principalId')]"
-            },
-            "slotSystemAssignedMIPrincipalIds": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              },
-              "metadata": {
-                "description": "The principal ID of the system assigned identity of slots."
-              },
-              "copy": {
-                "count": "[length(coalesce(parameters('slots'), createArray()))]",
-                "input": "[coalesce(tryGet(tryGet(reference(format('app_slots[{0}]', copyIndex())).outputs, 'systemAssignedMIPrincipalId'), 'value'), '')]"
-              }
-            },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "The location the resource was deployed into."
-              },
-              "value": "[reference('app', '2024-04-01', 'full').location]"
-            },
-            "defaultHostname": {
-              "type": "string",
-              "metadata": {
-                "description": "Default hostname of the app."
-              },
-              "value": "[reference('app').defaultHostName]"
-            },
-            "customDomainVerificationId": {
-              "type": "string",
-              "metadata": {
-                "description": "Unique identifier that verifies the custom domains assigned to the app. Customer will add this ID to a txt record for verification."
-              },
-              "value": "[reference('app').customDomainVerificationId]"
-            },
-            "privateEndpoints": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/privateEndpointOutputType"
-              },
-              "metadata": {
-                "description": "The private endpoints of the site."
-              },
-              "copy": {
-                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
-                "input": {
-                  "name": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
-                  "resourceId": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
-                  "groupId": "[tryGet(tryGet(reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
-                  "customDnsConfigs": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
-                  "networkInterfaceResourceIds": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
-                }
-              }
-            },
-            "slotPrivateEndpoints": {
-              "type": "array",
-              "metadata": {
-                "description": "The private endpoints of the slots."
-              },
-              "copy": {
-                "count": "[length(coalesce(parameters('slots'), createArray()))]",
-                "input": "[reference(format('app_slots[{0}]', copyIndex())).outputs.privateEndpoints.value]"
-              }
-            },
-            "outboundIpAddresses": {
-              "type": "string",
-              "metadata": {
-                "description": "The outbound IP addresses of the app."
-              },
-              "value": "[reference('app').outboundIpAddresses]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "applicationInsights",
-        "containerApp",
-        "logAnalyticsWorkspace",
-        "webServerFarm"
-      ]
-    }
-  },
-  "outputs": {
-    "webSiteDefaultHostname": {
-      "type": "string",
-      "metadata": {
-        "description": "The default url of the website to connect to the Multi-Agent Custom Automation Engine solution."
-      },
-      "value": "[reference('webSite').outputs.defaultHostname.value]"
-    }
-  }
-}
\ No newline at end of file

From af9e5b5c09be3e71e6392684ab3a02af0e653140 Mon Sep 17 00:00:00 2001
From: Ravi <v-rkirana@microsoft.com>
Date: Fri, 11 Jul 2025 17:02:11 +0530
Subject: [PATCH 67/70] Bug fix of #20489

---
 .../src/components/content/TaskDetails.tsx    | 113 +++++++++++++-----
 1 file changed, 81 insertions(+), 32 deletions(-)

diff --git a/src/frontend/src/components/content/TaskDetails.tsx b/src/frontend/src/components/content/TaskDetails.tsx
index efd16ecec..07fa665e8 100644
--- a/src/frontend/src/components/content/TaskDetails.tsx
+++ b/src/frontend/src/components/content/TaskDetails.tsx
@@ -146,45 +146,94 @@ const TaskDetails: React.FC<TaskDetailsProps> = ({
                       <Caption1>{functionOrDetails}</Caption1>
                     )}
                   </Body1>
-                  <div className="task-details-action-buttons">
+                    <div className="task-details-action-buttons">
                     {step.human_approval_status !== "accepted" &&
                       step.human_approval_status !== "rejected" && (
-                        <>             <Tooltip relationship="label" content={canInteract?"Approve":"You must first provide feedback to the planner"}>
-                          <Button
-                            icon={<Checkmark20Regular />}
-                            appearance="subtle"
-                            onClick={
-                              canInteract
-                                ? () => preOnApproved(step)
-                                : undefined
-                            }
-                            className={
-                              canInteract
-                                ? "task-details-action-button"
-                                : "task-details-action-button-disabled"
+                      <>
+                        <Tooltip relationship="label" content={canInteract ? "Approve" : "You must first provide feedback to the planner"}>
+                        <Button
+                          icon={<Checkmark20Regular />}
+                          appearance="subtle"
+                          onClick={
+                          canInteract
+                            ? async (e) => {
+                              // Disable buttons for this step
+                              setSteps((prev) =>
+                              prev.map((s) =>
+                                s.id === step.id
+                                ? { ...s, _isActionLoading: true }
+                                : s
+                              )
+                              );
+                              try {
+                              await preOnApproved(step);
+                              } finally {
+                              // Remove loading state after API call
+                              setSteps((prev) =>
+                                prev.map((s) =>
+                                s.id === step.id
+                                  ? { ...s, _isActionLoading: false }
+                                  : s
+                                )
+                              );
+                              }
                             }
-                          />
+                            : undefined
+                          }
+                          disabled={
+                          !canInteract ||
+                          !!step._isActionLoading
+                          }
+                          className={
+                          canInteract
+                            ? "task-details-action-button"
+                            : "task-details-action-button-disabled"
+                          }
+                        />
                         </Tooltip>
 
-                          <Tooltip relationship="label" content={canInteract?"Reject":"You must first provide feedback to the planner"}>
-                            <Button
-                              icon={<Dismiss20Regular />}
-                              appearance="subtle"
-                              onClick={
-                                canInteract
-                                  ? () => preOnRejected(step)
-                                  : undefined
-                              }
-                              className={
-                                canInteract
-                                  ? "task-details-action-button"
-                                  : "task-details-action-button-disabled"
+                        <Tooltip relationship="label" content={canInteract ? "Reject" : "You must first provide feedback to the planner"}>
+                        <Button
+                          icon={<Dismiss20Regular />}
+                          appearance="subtle"
+                          onClick={
+                          canInteract
+                            ? async (e) => {
+                              setSteps((prev) =>
+                              prev.map((s) =>
+                                s.id === step.id
+                                ? { ...s, _isActionLoading: true }
+                                : s
+                              )
+                              );
+                              try {
+                              await preOnRejected(step);
+                              } finally {
+                              setSteps((prev) =>
+                                prev.map((s) =>
+                                s.id === step.id
+                                  ? { ...s, _isActionLoading: false }
+                                  : s
+                                )
+                              );
                               }
-                            />
-                          </Tooltip></>
-
+                            }
+                            : undefined
+                          }
+                          disabled={
+                          !canInteract ||
+                          !!step._isActionLoading
+                          }
+                          className={
+                          canInteract
+                            ? "task-details-action-button"
+                            : "task-details-action-button-disabled"
+                          }
+                        />
+                        </Tooltip>
+                      </>
                       )}
-                  </div>
+                    </div>
                 </div>
               </div>
             );

From ee6daf4756820443c801920c6ba86d5a8aa736a8 Mon Sep 17 00:00:00 2001
From: Ravi <v-rkirana@microsoft.com>
Date: Fri, 11 Jul 2025 17:09:53 +0530
Subject: [PATCH 68/70] build error fix

---
 src/frontend/src/components/content/TaskDetails.tsx | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/frontend/src/components/content/TaskDetails.tsx b/src/frontend/src/components/content/TaskDetails.tsx
index 07fa665e8..8087ab695 100644
--- a/src/frontend/src/components/content/TaskDetails.tsx
+++ b/src/frontend/src/components/content/TaskDetails.tsx
@@ -1,6 +1,9 @@
 // TaskDetails.tsx - Merged TSX + Styles
 
-import { HumanFeedbackStatus, Step, TaskDetailsProps } from "@/models";
+import { HumanFeedbackStatus, Step as OriginalStep, TaskDetailsProps } from "@/models";
+
+// Extend Step to include _isActionLoading
+type Step = OriginalStep & { _isActionLoading?: boolean };
 import {
   Text,
   Avatar,
@@ -28,7 +31,7 @@ const TaskDetails: React.FC<TaskDetailsProps> = ({
   loading,
   OnApproveStep,
 }) => {
-  const [steps, setSteps] = useState(planData.steps || []);
+  const [steps, setSteps] = useState<Step[]>(planData.steps || []);
   const [completedCount, setCompletedCount] = useState(
     planData?.plan.completed || 0
   );

From 64203ff6a0bc5df85e6682361f762cadda412305 Mon Sep 17 00:00:00 2001
From: Ritesh <v-riteshmate@microsoft.com>
Date: Fri, 11 Jul 2025 18:18:54 +0530
Subject: [PATCH 69/70] test: MACAE_Updated_locator_send_button

---
 tests/e2e-test/pages/BIAB.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tests/e2e-test/pages/BIAB.py b/tests/e2e-test/pages/BIAB.py
index 37f58d705..d3b404bd7 100644
--- a/tests/e2e-test/pages/BIAB.py
+++ b/tests/e2e-test/pages/BIAB.py
@@ -9,7 +9,7 @@ class BIABPage(BasePage):
 
     WELCOME_PAGE_TITLE = "//span[normalize-space()='Multi-Agent Planner']"
     NEW_TASK_PROMPT = "//textarea[@placeholder='Tell us what needs planning, building, or connecting—we'll handle the rest.']"
-    SEND_BUTTON = "//button[@type='button']"
+    SEND_BUTTON = "//div[@role='toolbar']"
     CREATING_PLAN = "//span[normalize-space()='Creating a plan']"
     TASK_LIST = "//span[contains(text(),'1.')]"
     NEW_TASK = "//span[normalize-space()='New task']"
@@ -92,6 +92,7 @@ def enter_a_question(self, text):
     def processing_different_stage(self):
         """Process and approve each stage sequentially if present."""
         self.page.wait_for_timeout(3000)
+        total_count = self.page.locator(self.STAGES).count()
         if self.page.locator(self.STAGES).count() >= 1:
             for _ in range(self.page.locator(self.STAGES).count()):
                 approve_stages = self.page.locator(self.STAGES).nth(0)
@@ -103,5 +104,6 @@ def processing_different_stage(self):
 
                 plan_id = BasePage.get_first_plan_id(self)
                 BasePage.approve_plan_by_id(self, plan_id)
+                self.page.wait_for_timeout(7000)
 
-        expect(self.page.locator(self.COMPLETED_TASK)).to_contain_text("completed")
+        expect(self.page.locator(self.COMPLETED_TASK)).to_contain_text(f"{total_count} of {total_count} completed")

From 847baa79baf964d93bf48e14f228bd873dbabf61 Mon Sep 17 00:00:00 2001
From: Ritesh <v-riteshmate@microsoft.com>
Date: Fri, 11 Jul 2025 18:29:21 +0530
Subject: [PATCH 70/70] test: MACAE_updated_Locator_send_button

---
 tests/e2e-test/pages/BIAB.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/e2e-test/pages/BIAB.py b/tests/e2e-test/pages/BIAB.py
index ff7bf1278..25b19d82f 100644
--- a/tests/e2e-test/pages/BIAB.py
+++ b/tests/e2e-test/pages/BIAB.py
@@ -106,5 +106,5 @@ def processing_different_stage(self):
                 BasePage.approve_plan_by_id(self, plan_id)
                 self.page.wait_for_timeout(7000)
 
-        expect(self.page.locator(self.COMPLETED_TASK)).to_contain_text("completed")
+        expect(self.page.locator(self.COMPLETED_TASK)).to_contain_text(f"{total_count} of {total_count} completed")